Search-engine providers have begun to compete with each other on privacy protections, but the U.S. still needs to adopt a national privacy law, says a report from the Center for Democracy and Technology (CDT).
The CDT, a civil liberties advocacy group, praised many search-engine providers for recent changes to their privacy policies, with some policies setting limits on data retention. But CDT remains concerned that, in many cases, search-engine users have little control over their data and that most major search engines retain query data indefinitely, officials of the group said Wednesday.
CDT hopes privacy policy changes from several search-engine providers since mid-June "signal the emergence of a new competitive marketplace for privacy," CDT President Leslie Harris said. "We believe [providers] are starting to see privacy as a market differentiator."
However, the privacy announcements represent "only a small step" toward full privacy protections, Harris added.
The Center for Digital Democracy (CDD), an advocacy group focused on online privacy and free speech online, criticized the CDT report. CDT takes contributions from vendors, noted Jeff Chester, CDD's executive director.
"CDT has long been an ally of the various data collection companies it purports to oversee on behalf of consumers," Chester said. "The report released today fails to address the wide-ranging privacy threat coming from the major search engines and their advertising clients. It fails to acknowledge that it's only because of policy-related pressure from privacy advocates ... that there have been modest corporate changes."
But CDT officials, during their press conference, noted that public pressure has helped change privacy policies. The 13-year-old CDT has long included tech vendors in its issue working groups and accepted donations from them, Harris said. "Where I think that we have a basic difference [with CDD] is whether or not it makes sense to talk directly to the industry, or to simply speculate about what they're doing," she said. "We think the right approach is engagement."
In mid-June, Google announced it would delete IP (Internet Protocol) addresses and cookies linking searches to individual users after 18 months. The action, which came partly in response to privacy concerns from a European Union working group, preceded search-engine privacy announcements from Microsoft, Yahoo and Ask.com.
Google issued a statement about the CDT report: "When Google announced its decision to make our logs data anonymous after 18 months, we hoped it would stimulate action across the industry. We're delighted that it has -- because these developments are good for users."
Representatives of three other search-engine providers in the CDT report weren't immediately available for comment.
CDT's report includes a chart on how long major search-engine providers retain some data.
While Google and Microsoft will delete IP address and computer-identifying cookie data after 18 months, AOL and Yahoo will delete that information after 13 months. Ask.com, in a policy announced in July, will allow users to opt-out of data collection and have that information deleted within a few hours of their searches. If users don't opt out, Ask.com will retain IP addresses and cookie data for 18 months.
CDT praised Ask.com for its policy allowing users to opt out of data collection, saying Ask.com is the first major search engine to give users the choice to delete their information.
But policies at Google and Microsoft allow the companies to keep query data indefinitely. Yahoo keeps much of the query data indefinitely but deletes personally identifiable query data, according to the report. Ask.com keeps the data indefinitely unless users opt out, and then the query information is deleted within a few hours.
AOL, which last year posted data on about 650,000 searches made on the company's Web site, now will delete query information after 13 months.
"These policies really are a work in progress," said CDT policy analyst Alissa Cooper. "There's really a wide diversity of practices in this industry."
In addition to concerns about query retention, CDT officials said they remained concerned about search-engine providers sharing information with third parties. AOL and Ask.com share their search results with Google, which provides contextual advertising for them.
Search-engine users should have more control over their data, Cooper said. "Users should really be in control about when that information gets tied back to them," she said.