Search Privacy and the Microsoft-Yahoo! Agreement

As we have followed the rumors of a Microsoft-Yahoo deal over the last few months, the area we were most concerned about was the future of Yahoo’s leading search data retention policy. We have repeatedly praised Yahoo for implementing a data retention policy that seeks to anonymize search queries after 3 months and we have urged others to follow suit. We understand why companies need to retain data to improve their services and for the related advertising that supports these services. Analyzing what results are selected by users in response to certain queries over time is essential to providing increasingly relevant results. But search queries are sensitive and provide an unusually rich record of user activities online. Yahoo proved that it was serious about privacy when it adopted a policy of deleting information as soon as it was not needed. Would Yahoo’s policy survive the deal?

We are pleased to report that it will. In emails from the Microsoft and Yahoo privacy leads this morning and after a more detailed discussion with Yahoo privacy lead Anne Toth, we were pleased to learn that Microsoft will maintain Yahoo’s retention period for the search data from Yahoo that it will now receive. We hope that this search deal leads to a period of aggressive privacy competition between Google and Microsoft and that consumers benefit from efforts to provide relevant services in a privacy smart manner.

(You can see FPF’s Gallery of leading practices for an overview of some of the other more progressive privacy practices we have highlighted.)

What about anti-trust issues? We think that the question of whether and how privacy issues should be considered in conducting an anti-trust is critical. When the FTC approved the Google-DoubleClick merger, it rejected the idea that the merger would have a negative privacy impact, but it clearly said the privacy issues were relevant to be considered in an anti-trust review. Our former advisory board member Professor Peter Swire has done some very interesting thinking and writing in this area. Here are the points he raised last year in anticipation of this deal:

• Will Yahoo’s and Microsoft’s existing databases of personal information be merged?

• How will the pre-merger privacy policies apply after the merger?

• What privacy guarantees arising out of the merger might be incorporated into the post-merger privacy policies?

At initial review, it seems that Yahoo and Microsoft have addressed these points, assuring us that Yahoo search data won’t be available for other Microsoft systems and assuring us that privacy policies will be updated to address this. If we were strategizing this on the corporate side, we might have come up with one or two more privacy advances so as to have something in our pockets to offer later when Congress and the FTC get involved. Perhaps Microsoft adopting the shorter Yahoo policy for retention for its own data as well? The Article 29 group of European data regulators is aggressively pressing all the search providers to anonymize data after 6 months regardless, so this would be responsive to them and it would almost certainly obligate Google to match this policy.

We do not discount the concerns some will have about the consolidation of data in the hands of two companies.  But, to be pragmatic, it often requires real competition to kick-off privacy progress.  Consider the progress Internet Explorer has made in the recent years as Firefox has become a serious competitor.    We expect the same could happen here.