Yahoo! to purge personal data after 3 months

Thursday, December 18, 2008 

Internet giant Yahoo! announced on Wednesday that by January 2009 it will begin purging personal data collected when users access its search page at the 3 month mark, a far shorter time period than any of its search engine rivals such as Google, which retains personal data for 9 months, down from 18 months as of September, and Microsoft, which retains data for an 18 month period, though Microsoft has stated support for a six month industry standard. Prior to the announcement, Yahoo purged data at 13 months.

Just three years ago, the policy of all three search engines was to keep collected private data permanently, on the basis that it was necessary in order for them to run their services. However, in the wake of substantial public pressure, private advocacy and indications from regulators that if the industry did not police itself, it would be imposed upon them, all three companies instituted data protection schemes. Calls for shortening the time period before data is removed or obscured soon began and have grown in pitch.

Anne Toth, Yahoo's vice president of policy and head of privacy stated that "we want to take the issue of data retention off the table."

The move puts pressure on Google and Microsoft to follow suit, in a climate where European Union regulators have pushed for legislation, private advocacy groups are planning such a push in the U.S., and where Congress has raised questions about the extent Internet tracking of private data by telecommunications companies is being used to target advertising based on personal information.

Despite Yahoo's data policy being more restrictive than that of Google's or Microsoft's, personal data will not be destroyed entirely but will by "anonymized"—hidden in various ways, including: deleting the final eight bits of a user's IP address; changing the user's Yahoo! ID to a one-way, secret, hash code and deleting one half of the identifier created; a similar hash obscuring of all cookie identifiers; and will filter certain types of unique personal identifiers such as credit card and social security numbers. Additionally, Yahoo indicates that it will purge information on page views, ad views, page clicks and ad clicks.

In a press release, Massachusetts Democrat Edward J. Markey, chairman of the House Energy Subcommittee on Telecommunications and the Internet, praised the restriction, and stated, "I urge other leading online companies to match or beat the commitments announced by Yahoo."

Sources

• Elise Ackerman. "Yahoo to shorten time it stores user data to 3 months" — Mercury News, December 17, 2008
• Joelle Tessler. "Yahoo to shorten logs of user activity to 3 months" — The Associated Press, December 17, 2008
• Cade Metz. "Yahoo! mocks Google Privacy Theatre" — The Register, December 17, 2008
• Miguel Helft. "Yahoo Limits Retention of Personal Data" — The New York Times, December 17, 2008