Out-Law News 2 min. read

Yahoo! reduces search log retention period


Internet search company Yahoo! has said that it will now delete user information after 90 days. The company is now the quickest of the major search engines to delete usage logs, though some smaller search engines do not even store them in the first place.

Privacy watchdogs and search companies have battled over the last two years over whether and for how long companies should keep records of what internet address was used to conduct what online activity.

Google sparked the debate when it announced that it was no longer going to keep search logs indefinitely. EU privacy regulators including the watchdogs' umbrella group the Article 29 Working Party have since called for the information to be deleted within six months.

Yahoo! has now said that it will delete logs after three months except when there are accusations of fraud, security breaches or where there is a specific legal reason to keep logs.

Google pledged in September to halve the amount of time it would keep logs for from 18 months to nine months.

"This policy represents Yahoo!'s assessment of the minimum amount of time we need to retain data in order to respond to the needs of our business while deepening our trusted relationship with users," said Anne Toth, Yahoo!'s vice president of policy and head of privacy. "We're proud this new policy sets a new benchmark for the industry."

Yahoo! said that it was responding to an issue that users of online services are increasingly aware of. "Responsible use of data is critical to establishing and maintaining user trust," said Toth. "We know that our users expect relevant and compelling content and advertising when they visit Yahoo!, but they also want assurances that we are focused on protecting their privacy."

Yahoo! said that it would keep some system security and fraud related information for up to six months, but would only use it in relation to fraud or security. It said it might keep some information for longer than that if it had legal obligations to do so.

Search engine companies argue that they need the log data to improve the service they provide to users by analysing usage patterns. Privacy advocates claim that the retention of the information is a violation of privacy because in some cases activity could be linked to individual users.

Google used to argue that the European Union's Data Retention Directive forced it to keep data for between six and 24 months, but conceded earlier this year that this was not the case.

The Article 29 Working Party, which has on it the data protection watchdogs from the EU's 27 member states, published a report in April on privacy and search engines.

That report said that search engine companies should delete search logs after six months or risk falling foul of data protection legislation. Google said that the report did not take account of commercial reality.

Microsoft recently said that it would cut the length of time for which it keeps search logs but only if Yahoo! and Google did the same.

Some search engines operate without any retention of search logs at all. Dutch search engine Ixquick does so and was awarded the first Privacy Seal presented by privacy group EuroPriSE earlier this year.

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.