• by Wendy Davis  @wendyndavis, December 18, 2008

Yahoo's announcement Wednesday that it will "anonymize" most search logs within 90 days has drawn mixed reactions from privacy advocates.

On the one hand, the move is seen as a step forward from Yahoo's previous policy of retaining search logs for 13 months and those of rivals Google and Microsoft, who store search logs for nine and 18 months.

But some privacy advocates say Yahoo's new initiative might not be as consumer-friendly as it seems because the anonymization procedure doesn't completely scrub the data.

"We are always happy to see search companies competing on privacy," said Electronic Frontier Foundation attorney Lee Tien. But, he added, "The best defense, really, is to not keep the data in the first place."

Yahoo said Wednesday that it intends to anonymize most logs tying visitors' IP addresses to search queries by purging the last octet of an IP address. The company will also remove some information from its stored search queries, such as names, telephone numbers or other data likely to be associated with specific individuals.

But Yahoo will retain a truncated version of users' IP addresses, as well as search queries that don't contain names or other personal information. Yahoo also is keeping some proportion of data longer than three months to combat fraud or meet security obligations and legal mandates.

The limits have raised eyebrows among privacy advocates. Marc Rotenberg, executive director of the Electronic Privacy Information Center, described the plan as offering a "faux anonymity" to users. "Yahoo is not deleting the records and not anonymizing them in a meaningful sense," he said.

Rotenberg said that his organization today plans to file papers with President-elect Barack Obama's transition team, asking that the new administration address a host of Web privacy issues. He added that he hopes the new Federal Trade Commission chair more aggressively protects search users' privacy.

"It simply can't be the case that Internet users will get as much privacy as search companies are prepared to allow," he said.

Microsoft, which recently said it would anonymize search logs after six months if Google and Yahoo did the same, also highlighted Yahoo's failure to completely purge its search logs. "Microsoft believes that the method of anonymization is more important than the anonymization timeframe and believes all major search engines need to adopt a high standard," Brendon Lynch, Microsoft's director of privacy strategy, said Wednesday in a statement. Microsoft completely trashes searchers' IP addresses after 18 months.

Yahoo's move comes as European regulators have been pressuring search companies to delete users' IP addresses and other personal data after no more than six months. In Europe, a sweeping privacy law bans limits companies' ability to retain personal information about consumers. Some regulators in Europe have said they consider IP addresses the type of personal information that falls within the privacy law's purview.

In the U.S., there has been considerable debate about whether IP addresses should be considered "personally identifiable information." Some say that IP addresses in themselves don't reveal people's names, but privacy advocates argue that users' identities can be determined by examining IP addresses in context with other data.

In addition, in some instances, identities can be determined simply by examining all of the search queries originating from the same IP address, even if the address itself remains secret. The most famous example occurred two years ago, when AOL released "anonymized" search records of 650,000 users. The New York Times identified one and ran a front-page story about her within days of the search queries becoming public.

Rep. Ed Markey (D-Mass.) praised Yahoo's move Wednesday. "I have been pressing online companies for greater voluntary efforts to refrain from the massive, systematic gathering of information about individual consumer web use and the long term retention of such data in a form that can identify the web habits, interests, searches, and purchases of individual Americans," he said in a statement.

Markey has said he intends to introduce new privacy legislation next year.