Google To Anonymize Search Records After 18 Months

Google has been taking a lot of heat in the past few days over its privacy policies. Today the search giant decreased the amount of time that it ties users search records to their IP to 18 months in response to a letter from the Working Party, a group of national officials that advises the European Union on privacy policy. From the Official Google Blog:

After considering the Working Party’s concerns, we are announcing a new policy: to anonymize our search server logs after 18 months, rather than the previously-established period of 18 to 24 months. We believe that we can still address our legitimate interests in security, innovation and anti-fraud efforts with this shorter period. However, we must point out that future data retention laws may obligate us to raise the retention period to 24 months. We also firmly reject any suggestions that we could meet our legitimate interests in security, innovation and anti-fraud efforts with any retention period shorter than 18 months.

Google is currently deep in a fight with Privacy International, a watchdog group that picked Google as leading ‘the race to the bottom’ of privacy standards.

A few of Privacy International’s problems with Google:

• Google account holders that regularly use even a few of Google’s services must accept that the company retains a large quantity of information about that user, often for an unstated or indefinite length of time, without clear limitation on subsequent use or disclosure, and without an opportunity to delete or withdraw personal data even if the user wishes to terminate the service.

• Google maintains records of all search strings and the associated IP-addresses and time stamps for at least 18 to 24 months and does not provide users with an expungement option. While it is true that many US based companies have not yet established a time frame for retention, there is a prevailing view amongst privacy experts that 18 to 24 months is unacceptable, and possibly unlawful in many parts of the world.

• Google has access to additional personal information, including hobbies, employment, address, and phone number, contained within user profiles in Orkut. Google often maintains these records even after a user has deleted his profile or removed information from Orkut.

• Google collects all search results entered through Google Toolbar and identifies all Google Toolbar users with a unique cookie that allows Google to track the user’s web movement. Google does not indicate how long the information collected through Google Toolbar is retained, nor does it offer users a data expungement option in connection with the service.

• Google fails to follow generally accepted privacy practices such as the OECD Privacy Guidelines and elements of EU data protection law. As detailed in the EPIC complaint, Google also fails to adopted additional privacy provisions with respect to specific Google services.

• Google logs search queries in a manner that makes them personally identifiable but fails to provide users with the ability to edit or otherwise expunge records of their previous searches.

• Google fails to give users access to log information generated through their interaction with Google Maps, Google Video, Google Talk, Google Reader, Blogger and other services.

Google responded to Privacy International’s study by claiming that it was unfair. “We are disappointed with Privacy International’s report, which is based on numerous inaccuracies and misunderstandings about our services,” said Nicole Wong, Google’s deputy general counsel. “It’s a shame that Privacy International decided to publish its report before we had an opportunity to discuss our privacy practices with them.”

The privacy fight goes on. —MEGHANN MARCO

Google to limit data retention to 18 months [MSNBC]
Google’s Response To The Working Party (PDF)
A Race to the Bottom: Privacy Ranking of Internet Service Companies [Privacy International]
How Long Should Google Remember Searches? [Official Google Blog]
(Photo: OXOX)

Comments

Edit Your Comment

  1. roothorick says:

    Personally, I’m more comfortable handing my information over to Google knowing that they’re not going to be just giving it away to outside parties, and that they truly do have their customers’ interests in mind, unlike certain other companies. While the situation could be better, I’m not really complaining.

  2. othium says:

    Who ISN’T watching and recording our online activities these days?

    Just operate from the assumption that everything you type is being displayed on a police/government official’s computer.

  3. dsk says:

    @roothorick: As long as their customers’ interests include having targeted advertisements presented to them, I would have to agree that Google has their customers’ interests in mind.

  4. Odwalla says:

    If you use Firefox you can anonymize your Google, MSN, AOL,and Yahoo! searches on a regular basis using TrackMeNot (http://mrl.nyu.edu/~dhowe/trackmenot/). The AddOn sends out random searches at a time interval you specify. The theory being that your real searches will be obfuscated within the random searches the plugin generates.

  5. Sugarcoated says:

    Roothorick, Google’s “customers” are it’s advertisers who keep them fat and happy with giant piles o’ money — not you, who don’t pay them a dime to use all of their “free” services.

    If you’re comfortable having a multi-billion dollar corporation store that much personal information on you and having no say whatsoever in whom they sell it to or what they do with it, that’s your prerogative. Other people may not be so sanguine.

  6. kopfhorer says:

    Collection of data by itself isn’t the issue. It’s how certain third parties – employers, political opponents, personal enemies, terrorists, etc. – could use or misuse it that rightly raises eyebrows.

  7. @roothorick: They don’t have to give it away if the information is compromised.

  8. Trai_Dep says:

    On the plus side, Google is the only company on the planet that told the US government to f*ck themselves when they tried getting years of search data on the sly, forcing them to back down and publicizing it (thanks, Yahoo, MSN!).

    On the debit: 18 freaken months is a compromise?!

  9. synergy says:

    No one should be keeping any records about me without my permission. Hence, I don’t use Google. Ever. If I do, it’s a complete accident and I curse.

  10. Trai_Dep says:

    syn:
    So you don’t use search engines, ever? Cuz you know they all track requests, right? They can’t do their job otherwise. (it’s how LONG they retain that’s the issue). Of the Big Three, Google’s stuck it to The Man the hardest…

  11. zybler says:

    Sugarcoated:
    While I agree with you that privacy is an issue to some, I believe the problem lies in the way the data is being handled, not data being collected per se. Most of the data being collected by google are useful in the sense they can be analyzed and be used to improve their services.

    If that’s not something you can accept, then the policy dictates you not to used their services. End of story.

  12. MarahMarie says:

    @ trai_dep:

    This is inaccurate:

    “On the plus side, Google is the only company on the planet that told the US government to f*ck themselves when they tried getting years of search data on the sly, forcing them to back down and publicizing it (thanks, Yahoo, MSN!).”

    Nuh-uh, that’s all wrong. Google couldn’t have cared less about turning over the search data, but they claimed doing so would reveal their “trade secrets.” They are protected by law from compromising any such secrets. The gov’t would have gotten the search data if Google hadn’t got off on that technicality.

    That Google “saved” it’s users or “fought for them” is untruthful. They only sought to protect themselves.

    “On the debit: 18 freaken months is a compromise?!”

    Indeed. 18 *hours* is still 17 hours and 59 minutes too long for me.

  13. aikoto says:

    What no one has found the answer to yet is why they need to tie search data to individuals at all. Of course they need search data for improving their service, but otherwise, why tie it to profiles?

  14. mattbrown says:

    humm… who cares? any damage that would be done, would’ve been done by then. That gives whoever, where ever they may be, 18 months to copy the entire database and call it their own. Thanks Google! ;)

  15. nevergod says:

    well ive come to the point that SOMEONE is at least to some degree paying attention to everything everybody is doing. i geuss i’ll blindly trust google over someone else. i’ll live.