The new battle among Ask.com, Google, Microsoft, and Yahoo isn't about who has the best search. It's a duke-it-out over who will do the best job in preserving your privacy.

The competition began with Google's announcement earlier this year that it would modify saved search logs after 18 months so that particular searches couldn't be tied to specific people. That may not sound like a battle cry, but the other major search engines fired quick salvos in response to prove that they, too, care about your privacy. The planned changes vary in terms of what gets saved and for how long, but on the whole they should improve your privacy somewhat. But will they make a real difference? Or is it all PR?

"This is the most competition we've had in privacy in ten years," says Ari Schwartz of theCenter for Democracy and Technology, referring to privacy-oriented changes in the works for saving search logs, serving targeted online ads, storing cookies, and working with content partners. The CDT is a Washington, D.C.-based think tank active on privacy issues, and consulted with the companies as they made their plans.

Schwartz says that while some updates, such as Google's plans for cookies, don't amount to much, others mark a definite positive change. In particular, Microsoft and Ask's plans to hold content partners to the same policies that Microsoft and Ask will use show that the companies are trying to take steps to improve the industry, he says.
"They know that there's concern about trust on the Internet," he says. "That makes real competition for privacy."
However, other privacy advocates--while welcoming the recent attention to how our personal information is stored and used--aren't nearly as optimistic about the recent announcements.

"I'm pleased to see that the companies are addressing privacy issues," says Marc Rotenberg, executive director of theElectronic Privacy Information Center, which is also located in Washington, "but I think they have a long way to go."
In addition, according to Rotenberg, these company announcements don't address another major privacy concern.
This concern is the trend for major search and ad company mergers, such as Microsoft's recently approved purchase of aQuantive, for example, and Google's proposed purchase of DoubleClick, which could mean extensive, consolidated databases chock full of personal information.

According to Schwartz, the search companies all had changes in the works, but Google sparked the competition with its announcement that it wouldpartially anonymizeuser search records, first saying that search records would be saved for 18 to 24 months, and then dropping that down to 18 months.

The search giant saves records of what you searched for, based on your computer's IP address and a unique identifier stored in a cookie. After 18 months, Google will pull the cookie ID from the search record and clear the final numbers from the IP address, which won't allow for tying searches to one person but will still allow the company to peg the general geographic location.

Other companies followed suit, partly to vie with Google, partly for compliance reasons, and "partly because they thought it was the right thing for them to do," says Schwartz.

Each of the announcements appeared meant to outdo competitors. Microsoft declared it would also anonymize search logs after 18 months, but would clear the entire IP address. And Yahoo leapfrogged the others by committing to a period of only 13 months.

Ask will anonymize logs after 18 months, but it pulls far ahead of other search companies with its plans for a newAskEraser servicethat will give users the option to prevent storing any search records. The company announced that "searchers' privacy settings will be clearly indicated on search results pages so they always know the privacy status of their searches."

These changes to search log retention, which should take effect by the end of the year, are generally welcome and could help reduce the chances for another data leak fiasco along the lines of AOL's release of20 million Web search recordslast year.

But Google'splan for its cookies, which sounds like an improvement on the surface, isn't receiving such a warm welcome. The company says it will drop the expiration time for its cookies, which allow the company to tie a specific search to a unique identifier contained in the cookie, from 30 years down to 2 years.

However, "the two-year rule is not a particularly good one for privacy," Schwartz says. It's a mild improvement, but unlike now with the 30-year cookie, the two-year version will auto-renew every time you visit Google. That allows for a theoretical life-span well beyond three decades, given how often the average person runs a Google search--if a particular PC and browser actually stuck around that long.

Targeted Ads

Schwartz is similarly lukewarm towards Microsoft's decision to allow users to opt out of targeted ads based on their browsing behavior, along with other principles from the National Advertising Initiative, an ad industry group that Microsoft has just joined.

"The [NAI] principles are out-of-date," Schwartz says. "They were done in a completely different environment. They now apply to an advertising world that basically doesn't exist today." One change that should occur, he says, is for users to have to opt in before ad networks could track their behavior for targeted ads, instead of having to opt out of such practices.

But Schwartz is heartened, he says, by what he sees as a general push from Microsoft and Ask to move the rest of the industry towards better privacy practices. Both companies recently announced plans to restrict what data their content partners can collect and use if they display ads from those companies or display video on their sites. Microsoft and Ask also recentlyissued a joint callfor global privacy practices.

"Limiting how others use information ... shows that they're trying to take steps to improve the industry," Schwartz says.

But others feel there's much more room for improvement.

"On the one hand, it's good that the companies are paying attention to privacy issues in the online advertising sector as well as with search services," says Rotenberg of EPIC. "On the other hand, I don't think the changes that have been announced address the really big issues."

If Ask's AskEraser proves to be genuinely anonymous, then "that's a good thing, and what the industry should be moving towards." But Google's partial masking of the IP address in search logs isn't real anonymization, he says, and he can't imagine the benefit from a two-year cookie renewal period.

For the cookie to actually expire, Rotenberg says, "basically that means you haven't touched a keyboard for two years and run a search." And like Schwartz, he believes Microsoft's opt-out policy for targeted ads should be opt-in.
But the real concern, Rotenberg adds, is with the current push by search companies to expand their businesses by purchasing online ad companies. In particular, Google's planned merger with DoubleClick would give the combined firm a wealth of stored personal data, he says. EPIC filed a complaint (pdf) on April 20 with the Federal Trade Comission opposing the move.

With companies under pressure from increasingly privacy-aware consumers, Rotenberg says, "I think you'll continue to see companies try to address the concerns."

But the "safeguards can't just be what the companies are prepared to do," he says. "We need meaningful safeguards."