• by Laurie Petersen , August 9, 2007

The Washington, D.C.-based Center for Democracy and Technology issued a report on the state of search privacy practices and called on the Federal Trade Commission to reevaluate the 5-year-old National Advertising Initiative guidelines for behavioral marketing and data collection.

"After five years of experience with the NAI guidelines and a host of technical developments in online advertising, we believe it is high time to re-evaluate the privacy protections that are currently in place," the CDT wrote. "Technologies developed since the adoption of the guidelines allow both increased profiling and tracking capabilities and increasingly granular user control, all of which deserve fresh consideration."

CDT praised some recent initiatives, such as AskEraser, which allows searchers to delete evidence of a search upon its completion. But by and large, it said, some consistency and guidelines enforced from the top down would prove more effective in the long run and help protect consumers from "bad actors" in the business.

"As search becomes an increasingly essential part of so many Internet users' daily lives, the search engines' recently announced policies (see charts below) begin to place control of sensitive information back into the hands of users, limiting the risk that consumers' personal data will be misused, lost, stolen or otherwise compromised," CDT wrote in a report "Search Privacy Practices: A Work in Progress."

CDT issued the following recommendations:

Search companies should continue to work towards providing controls that allow users to not only extend but also limit the information stored about them. As it becomes possible to tie more and more information back to an individual user account, users should control the correlation of their account information with records of their online activities.

Researchers, academics and Internet companies should continue to pursue new and innovative methods for (1) improving the quality of search results, preventing fraud and otherwise meeting business needs without tying searches to particular users, and (2) safeguarding data that is stored for long periods.

Search companies should expand efforts to develop policies that balance the demands of the advertising marketplace with their users' privacy needs. This should include the development of new standards and policies that take privacy into account from the beginning.

Internet companies should leverage their contracts with partners to promote privacy protections across the board. Consumers can also exert pressure to improve privacy practices by staying informed and making use of available privacy tools.

No amount of self-regulation in the search privacy space can replace the need for a comprehensive federal privacy law to protect consumers from bad actors. With consumers sharing more data than ever before online, the time has come to harmonize our nation's privacy laws into a simple, flexible framework.

The FTC has set a Nov. 1-2 "Town Hall" meeting to discuss behavioral targeting and privacy issues. Additional Congressional hearings are expected to be held when Congress resumes in September.

SEARCH PRIVACY PRACTICES

How long after search data has been collected will it be removed?

Companies in order of share of U.S. searches	IP address	Cookie ID	Query
Google (Policies will be in place by Dec. 2007, applied retroactively.)	18 months	18 months	Indefinite
Yahoo (Policies will be in place by July 2008. Currently reviewing how to apply policies to historical data.)	13 months	13 months	Indefinite. Some queries will be removed automatically by personal information filter after 13 months.
Microsoft (Policies will be in place by July 2008, applied retroactively.)	18 months	18 months	Indefinite
Ask.com (Policies will be in place in 2007. Currently reviewing how to apply policies to historical data. For users who opt out of having Ask retain their search data (via AskEraser)	Few hours	Few hours	Few hours
Ask.com For all other users:	18 months	18 months	Indefinite
AOL (Policies will be in place by 2007, applied retroactively.)	13 months	13 months	13 months

Source: Center for Democracy & Technology

How will search data be removed?

Companies in order of share of U.S. searches	IP address	Cookie ID	Query
Google (Policies will be in place by Dec. 2007, applied retroactively.)	Deletes last octet.	Deletes partial or complete ID (specifics TBA).	Does not remove.
Yahoo (Policies will be in place by July 2008. Currently reviewing how to apply policies to historical data.)	Deletes last octet(s) of address.	Deletes some portion of ID (specifics TBA).	Applies personal information filter to remove names, SSNs, etc.
Microsoft (Policies will be in place by July 2008, applied retroactively.)	Deletes complete address.	Deletes complete ID.	Does not remove.
Ask.com (Policies will be in place in 2007. Currently reviewing how to apply policies to historical data. For users who opt out of having Ask retain their search data (via AskEraser)	Deletes complete address.	Deletes complete ID.	Deletes complete query.
Ask.com For all other users:	Deletes complete address or last octet(s) (specifics TBA).	Deletes complete ID.	Does not remove.
AOL (Policies will be in place by 2007, applied retroactively.)	Deletes complete address.	Deletes complete ID.	Retains only aggregate statistics about search query frequency.

Source: Center for Democracy & Technology

Is most or all search data shared with a third party on an ongoing basis?

Companies in order of share of U.S. searches
Google (Policies will be in place by Dec. 2007, applied retroactively.)	No
Yahoo (Policies will be in place by July 2008. Currently reviewing how to apply policies to historical data.)	No
Microsoft (Policies will be in place by July 2008. applied retroactively.)	No
Ask.com (Policies will be in place in 2007. Currently reviewing how to apply policies to historical data. For users who opt out of having Ask retain their search data (via AskEraser)	Shares most query and IP address data with Google for provision of sponsored search results. Contractually limits uses of such shared data to providing and improving the partner's specific service and detecting fraud.
Ask.com For all other users:
AOL (Policies will be in place by 2007, applied retroactively.)	Shares query and IP address data with Google for purposes of delivering AOL search and advertising. Contractually limits uses of such shared data to providing and improving AOL's specific service and detecting spam and fraud.

Source: Center for Democracy & Technology