• by Wendy Davis  @wendyndavis, August 15, 2006

AOL's public release of search records of more than 650,000 members continues to cause ripples for the company. In the latest development, the advocacy group Electronic Frontier Foundation Monday filed a complaint with the FTC, charging that AOL's release of the data constituted unfair and deceptive trade practices.

The organization asked the FTC to step in and order AOL to change a variety of its practices. Most significantly, the group asked the FTC to prohibit AOL from storing information about users' searches for longer than 14 days.

"When companies retain consumer data for unnecessarily long periods of time, they create security risks," wrote the EFF in its complaint. "Public policy thus weighs in favor of requiring companies to keep consumer information only as long as absolutely necessary to provide the services that consumers request."

AOL declined to comment on the complaint.

The EFF's accusations stem from AOL's posting of search records for 658,000 members on a publicly accessible Web site. The records were online for about one week before bloggers found the site and started writing about it. Although AOL took down the records on Sunday, Aug. 6, some Web users had already made and posted copies online.

The EFF in its complaint also asked the FTC to investigate the circumstances of AOL's release of data, order AOL to notify all users whose searches were disclosed, and pay for credit monitoring services for those members. AOL maintains it is unable to notify the users whose records were posted because the members were selected randomly and their IDs were scrambled.

When AOL posted the data, the company "anonymized" the users by replacing their names with numbers. But the search queries themselves provided clues to users' identities. For example, last week The New York Times identified and profiled one supposedly anonymous AOL member, Thelma Arnold, whose search history had been released.

The EFF alleged in its complaint that it conducted a preliminary analysis of the search data and found a host of information that could be used to identify users: 175 searches by 106 users that appear to contain social security numbers; 8457 searches from 3739 users that seem to contain phone numbers; and 10835 searches from 4099 users that look like they contain street addresses. The EFF also reported finding multiple examples of search histories with names, birth dates, driver's license numbers and other personal information.

While the complaint deals mainly with AOL, the EFF also is concerned about other search companies' retention of information about users' searches. Google CEO Eric Schmidt said as recently as last week that his company intends to continue to retain users' search records, despite the possibility that doing so could compromise Web users' privacy.

But EFF lawyer Marcia Hoffman said that an FTC action against AOL could have an impact on how Google and other companies handle consumer data. "One reason we thought the FTC was a good place to go with this was because, very often, if the FTC takes action, it sets a standard for the whole industry," Hoffman said.