How search engines rate on privacy

In the last few months, the search engine business has experienced its own version of cutthroat competition: a privacy policy war, with Google, Ask.com and Microsoft vying to outdo one another in protecting their users' personal information.

But it's been difficult to make direct comparisons, in part because privacy policies tend to be written by lawyers for lawyers. So CNET News.com did some of the work for you by surveying the five leading search companies.

Starting on August 6, we asked them eight questions, including how long they retain search data, how they eventually dispose of it, whether they engage in behavioral targeting, and whether they use information they have from user sign-ups to guide which ads are displayed. We asked follow-ups where necessary for clarification.

The verbatim results of the survey are posted in an accompanying story.

The answers suggest that, based on the questions we asked, Ask.com was the most protective of user privacy. In fact, only Ask.com said it would not record what users type into its search engine. (Smaller search engines, including ixquick, said this as well, but we limited our survey to the five largest engines.) Ask.com also said it did not engage in behavioral targeting, which refers to the practice of offering advertisements based on previous searches.

And the rest? Results were mixed. Google avoids behavioral targeting, but after 18 months it performs a partial anonymization of users' Internet Protocol addresses--an action that's not terribly privacy protective. Google dominates the search market: 53 percent of U.S. Web searches in June were performed on its site, according to Nielsen/NetRatings.

Microsoft is better on the anonymization front. Peter Cullen, the company's chief privacy strategist, said users' Internet addresses and cookie values are "permanently and irreversibly" disassociated from the search terms after 18 months. But Microsoft does engage in behavioral targeting, while Google doesn't. Yahoo and AOL were similarly mixed.

These were, nevertheless, remarkable improvements. Google, Microsoft and Yahoo told News.com, in response to an earlier survey we did in February 2006, that they kept search records for as long as the data prove useful. Now they've set expiration dates, and Ask.com went further by promising to stop recording user search histories starting later this year. Google also has shortened the lifespan of its cookies from expiring in 2038 to expiring two years from the last visit.

Search privacy is important because our Googling (and Yahooing, and MSNing and so on) provides a unique glimpse into our personalities and private lives. Search terms have been used to convict a wireless hacker and lock up a man charged with killing his wife. Search engine activity is also a fertile growth area for nosy divorce lawyers and employment disputes.

One relatively simple way to protect your privacy when using search engines is to configure your browser to not permit them to place cookies on your computer. (Here's an FAQ on the topic.) Another way is to route all your connections through a proxy server such as Anonymizer, Tor or Black Box Search.

Market rivalry and regulatory threats
What all this amounts to is that the best search engine to use, from a privacy perspective, depends on what's most important to you.

Are you worried about a company publishing even anonymized search terms, as AOL did last year? Then use one that deletes your data sooner, or disable cookies for that site (at the price of not being able to use features like Web-based e-mail). Do you dislike seeing ads presented according to a computer-generated profile that was crafted based on your search terms? Then use Ask.com or Google, because the other three companies we surveyed do behavioral targeting. Worried about someone perusing your search history in person? Use software like PGP or Mac OS X's FileVault to encrypt part or all of your hard drive.

In addition to the normal forces of marketplace rivalry, another recent factor has been government regulatory threats. A group of European bureaucrats, called the Article 29 Working Party, has been pressuring search companies to store information for a shorter period of time. Last year, there was even a bill introduced in the U.S. Congress that would have forced Web sites to delete personal information if not required for "legitimate" business purposes.

Behavioral targeting is another growth area--not only for search companies, but for bureaucrats and politicians as well.

Google's proposed $3.1 billion acquisition of the DoubleClick ad company is being investigated by U.S. regulators after the purchase was challenged on competition and privacy grounds. Microsoft has received regulatory approval to buy online ad firm Aquantive, and Yahoo acquired online ad exchange Right Media. More recently, AOL said it was planning to acquire behavioral-targeting firm Tacoda.

The companies say they're following industry standards, with both Microsoft and Yahoo noting in our survey that they perform behavioral targeting only in accordance with Network Advertising Initiative principles. But liberal groups are becoming increasingly vocal, and the Federal Trade Commission last week announced it would hold a two-day forum in November to address behavioral advertising concerns.