Verbatim: Search firms surveyed on privacy

We asked the same seven questions of each company. Their answers are reproduced below, with the responses sorted by the companies' names in alphabetical order.

AOL spokesman Andrew Weinstein

Q: What information do you record about searches? Do you store IP addresses linked to search terms and types of searches (image vs. Web)?
Weinstein: Any time a search is done on the AOL service or AOL.com, the left rail on the results page offers a list of the most recent searches conducted by that user.

Thus, every time a user conducts a search, they automatically see their recent searches on the results screen, or they can review a list of the searches they have conducted over recent weeks by clicking on the "view all saved searches" button underneath those results or on the "saved searches" icon at the top of the results page.

The user has the ability to delete any individual search they have conducted by clicking on the trash icon next to it, or to delete them all by clicking on the "clear all" link on the results page.

Similarly, both the results and "saved searches" pages offer users the ability to "turn off" this functionality with two clicks. If a user opts out, AOL will no longer save or use their search results data. (Users can turn that functionality back on, of course, if they would prefer to have access to that data and the customization AOL can provide with it).

Past search terms and user preferences are associated with the user via a cookie that is linked to the screen name (if authenticated) or the browser, if not.

Given a list of search terms, can you produce a list of people who searched for that term, identified by IP address and/or cookie value?
Weinstein: No. Our systems are not configured to track individuals or groups of users who may have searched for a specific term or terms, and we would not comply with such a request.

Have you ever been asked by an attorney in a civil suit to produce such a list of people? A prosecutor in a criminal case?
Weinstein: Although we do not discuss what subpoenas or legal requests we may have received, we could not provide such information if asked.

Given an IP address or cookie value, can you produce a list of the terms searched by the user of that IP address or cookie value?
Weinstein: Yes. But--as discussed above--those terms are also visible to the user with their search results, and the user has the ability to delete any/all of those terms, or to turn off that functionality altogether.

Have you ever been asked by an attorney in a civil suit to produce such a list of search terms? A prosecutor in a criminal case?
Weinstein: We do not comment on subpoenas or legal requests we may have received. However, if the government came to us for records relating to the search behaviors of an individual subscriber, the subpoena would be covered by federal law under the Electronic Communications Privacy Act.

Do you ever purge these data, or set an expiration date of, for instance, two years or five years?
Weinstein: As stated on our searches results page, we currently save personally identifiable search data for up to 30 days. As stated above, users can delete that data at any time if they wish.

Do you ever anticipate offering search engine users a way to delete that data?
Weinstein: We already do. :)

(Editor's note: In a follow-up conversation, AOL added that not only is the information deleted, but backups are not kept either.)

Google spokesman Steve Langdon

Q: What information do you record about searches? Do you store IP addresses linked to search terms and types of searches (image vs. Web)?
(Editor's note: Google pointed to its list of Frequently Asked Questions on Google.com, which says in detail what is collected and stored.)

Given a list of search terms, can you produce a list of people who searched for that term, identified by IP address and/or cookie value?
Langdon: Yes. We can associate search terms with IP addresses and cookies, but not with users' names unless they are registered with Google.

Have you ever been asked by an attorney in a civil suit to produce such a list of people? A prosecutor in a criminal case?
Langdon: We do not share information about that. (Editor's note: Google did acknowledge, however, that it has had legal requests for Gmail e-mail.)

Given an IP address or cookie value, can you produce a list of the terms searched by the user of that IP address or cookie value?
Langdon: Yes.

Have you ever been asked by an attorney in a civil suit to produce such a list of search terms? A prosecutor in a criminal case?
Langdon: We do not share information about that.

Do you ever purge these data, or set an expiration date of, for instance, two years or five years?
Langdon: We keep data for as long as it is useful. There are several uses, several of which are described in our privacy policy and FAQ. There isn't a specified period.

Do you ever anticipate offering search engine users a way to delete that data?
Langdon: We have no plans to announce such a product. However, users can use Google without a cookie.

Adam Sohn, director of global marketing, sales and PR, Microsoft MSN

What information do you record about searches? Do you store IP addresses linked to search terms and types of searches (image vs. Web)?
Sohn: We record the query, the type of search (image, Web, local, etc.), the date and time that it was processed, the IP address from which the query came, and an anonymous, cookie-based unique ID. Storage of IP address information is common to many search engines. Microsoft maintains IP address to improve and protect the quality of our service, including for example the detection and diagnosis of fraudulent activity, security monitoring and intrusion detection and prevention, and the general operational health of the service. We use these records to look for anomalous patterns which indicate fraudulent activity. This helps use ensure that search results are not being manipulated

MSN does not currently maintain any other unique ID associated with an individual with MSN search queries.

Given a list of search terms, can you produce a list of people who searched for that term, identified by IP address and/or cookie value?
Sohn: We can provide a list of the IP addresses and cookie values for a given query, but this does not equate to a list of "people," only to a list of IP addresses and anonymous temporary ID numbers. We do not link search terms with personally identifiable information, and we have not designed our systems to enable that to be done. As a matter of standard business practice, we do not compile such lists. Mapping as described above would be done only for the purpose of responding to the legal request.

Have you ever been asked by an attorney in a civil suit to produce such a list of people? A prosecutor in a criminal case?
Sohn: While Microsoft normally does not comment on specific government inquiries, we can state that Microsoft has never received either criminal or civil requests to product such lists of people in conjunction with their MSN Search histories. It is our policy to respond to legal requests in a very responsive and timely manner in full compliance with applicable law. Microsoft is committed to maintaining user privacy, and any provision of data to law enforcement is driven by processes that help ensure that all legal requirements and privacy commitments have been met.

Given an IP address or cookie value, can you produce a list of the terms searched by the user of that IP address or cookie value?
Sohn: Yes. As a matter of standard business practice, we do not compile such lists. Mapping as described would be done only for the purpose of responding to the legal request.

Has you ever been asked by an attorney in a civil suit, or a prosecutor in a criminal case, to produce such a list of search terms?
Sohn: It is our policy to respond to legal requests in a very responsive and timely manner in full compliance with applicable law. The DOJ did contact us in the ACLU v. Gonzales case, but Microsoft has not received either criminal or civil requests related to MSN Search data before the subpoena in this case. We take the privacy of our customers very seriously. No personally identifiable information was requested, and none was supplied whatsoever. We shared some aggregated query data (not search results) and a small sample of pages in our index.

Do you ever purge these data, or set an expiration date of, for instance two years or five years?
Sohn: We do delete data today based on needs to run and maintain the services effectively; however we do not have details to share with regard to specific timeframes. We are reviewing our retention policies in light of European Union data retention regulations and will continue to work to set a reasonable time frame for purging data that balances privacy concerns with the need to meet important and legitimate business needs (such as fraud detection and prevention, as discussed above), along with the requirement to meet data retention laws.

Do you ever anticipate offering search engine users a way to delete that data?
Sohn: Some customers have expressed interest in MSN providing users more options regarding the types of data that MSN stores from their search sessions and the length of time that we store it. We are currently looking at ways that we might do that, but we do not yet have any firm plans.

Yahoo spokeswoman Mary Osako

Given a list of search terms, can you produce a list of people who searched for that term, identified by IP address and/or cookie value?
Yes, we can.

Have you ever been asked by an attorney in a civil suit to produce such a list of people? A prosecutor in a criminal case?
It's our company policy not to comment on legal matters.

Given an IP address or cookie value, can you produce a list of the terms searched by the user of that IP address or cookie value?
Yes, we can.

Have you ever been asked by an attorney in a civil suit to produce such a list of search terms? A prosecutor in a criminal case?
It's our company policy not to comment on legal matters.

Do you ever purge these data, or set an expiration date of, for instance, two years or five years?
We maintain data that will help us provide users with the best possible experience. Protecting our users' privacy and maintaining their trust is paramount to us.

Do you ever anticipate offering search engine users a way to delete that data?
We are always considering new ways to improve the user experience while preserving the high level of trust people have in us.