Google Reluctantly Halves Search Data Retention to 9 Months

Google Sept. 8 agreed to halve the time it stores IP addresses on its search server logs, decreasing the time period to nine months from 18.

Google, under fire from privacy advocates and facing a significant inquiry by the Department of Justice over its search advertising deal with Yahoo, is essentially caving to calls from European Union privacy regulators in this response to the EU's working party opinion on data protection issues related to search engines.

"We're significantly shortening our previous 18-month retention policy to address regulatory concerns and to take another step to improve privacy for our users," wrote Google's Peter Fleischer, global privacy counsel; Jane Horvath, senior privacy counsel; and software engineer Alma Whitten in a blog post.

The news shows the screws are being pressed harder into Google regarding privacy issues. Earlier Sept. 9 the Association of National Advertisers sent a letter to the U.S. Department of Justice denouncing Google's pending search advertising pact with Yahoo as bad for advertisers and recommending that it be blocked.  

Also Sept. 9, the Wall Street Journal reported that the DOJ has rock star lawyer Sanford Litvack, a sign that the DOJ may wish to challenge Google's deal with Yahoo, which involves Google selling search ads on Yahoo's portal for four to 10 years. Many advertisers, and perhaps now regulators such as the DOJ, see the deal as anti-competitive for the online ad market.  

And now Google has kowtowed again to the EU on privacy. Fleischer, Horvath and Whitten make the case that reducing the period before anonymizing "would degrade the utility of the data too much and outweigh the incremental privacy benefit for users." They added:

The problem is difficult to solve because the characteristics of the data that make it useful to prevent fraud, for example, are the very characteristics that also introduce some privacy risk. After months of work our engineers developed methods for preserving more of the data's utility while also anonymizing IP addresses sooner. We haven't sorted out all of the implementation details, and we may not be able to use precisely the same methods for anonymizing as we do after 18 months, but we are committed to making it work.

Resource Library:

The trio added that they are concerned that as the period prior to anonymization gets shorter, the added privacy benefits are less significant and the utility lost from the data grows.

I'm not sure anyone is buying that shortening the time to anonymization reduces fraud, but it will be interesting to see how the blogosphere treats this "Woe is me" post from Google.  

I don't envy Google, which while it is succeeding tremendously finds itself in a tricky position.

Google opponents have centered on two concerns. They are upset that consumers' privacy rights are being violated by Google's data collection activities via search and that Google's growth practices are lending it a Microsoftian power on the Internet. 

Indeed, this twofold challenge reminds me of the two-headed Internet Explorer/Windows desktop operating system issue Microsoft faced nearly a decade ago when the software giant was persecuted and ultimately chastened by the DOJ.