Yahoo cuts data retention to three months

WASHINGTON, USA: Search engine Yahoo! Inc will cut to three months the time it stores personal data gathered from Web surfing, making its retention policy the shortest among peers, the company said on Wednesday.

The company will "anonymize" the computer addresses of its users within three months in most cases, from a prior standard of 13 months. It is reserving the right to keep data for up to six months if fraud or system security are involved.

Internet search companies have come under pressure from European and other data protection officials to do more to protect the privacy of users.

Earlier this year, industry leader Google Inc halved the amount of time it stores personal data to nine months. Microsoft Corp has said it will cut the time to six months if its rivals did the same.

"Google first went to 18 months and started this competition," said Ari Schwartz, vice president at the Center for Democracy and Technology, a privacy advocacy group.

Yahoo's pledge is "significant because they are getting rid of some data after 90 days and they actually have an implementation plan to get this done," he added.

The company is also expanding the scope of the data it is making anonymous, to include page and advertisement clicks and views, from just search log data alone.

The European Union has recommended that companies keep data no more than six months and urged the sector to adopt an industry-wide standard.

"This was our attempt to put a stake in the ground" on the issue, Yahoo vice president of policy and privacy chief Anne Toth said.

Internet search engines get their revenue by matching advertisements to searches, so advertisers can peg their ads to what is on the searcher's mind.

Rivals weigh in

Microsoft said it welcomed the move, but made a distinction between the timeframe and the method of making data anonymous.

Yahoo will delete the final segment of the Internet Protocol (IP) address, which it said makes it no longer unique or identifiable.

Microsoft is deleting all of the Internet address, which it said will break any potential link to a particular set of search queries, according to Brendon Lynch, director of privacy strategy at the software giant.

"The best anonymization is to get rid of all the identifying information," Schwartz said. "We are still not there on an industry standard."

Google reiterated in a statement its current policy of nine months and said it is "continually evaluating" its policies with respect to privacy.

Ask.com, owned by IAC/InterActiveCorp., recently offered customers the ability to "opt out" of having their information stored for more than a few hours.

Yahoo's Toth said the company is not considering such a policy.

Once the companies make commitments on data retention, they are enforceable under federal and state laws in the United States, Schwartz added.