Microsoft Will Delete Bing User Data After Six Months

Microsoft will delete the stored IP addresses of Bing users after six months, apparently in response to privacy concerns from advocates and regulators.

"We will delete the entire Internet Protocol address associated with search queries at six months rather than 18 months," Peter Cullen, Microsoft's chief privacy strategist, wrote in a Jan. 18 posting on the Microsoft On The Issues blog. "This change is the result of a number of factors including a continuing evaluation of our business needs, the current competitive landscape and our ongoing dialogue with privacy advocates, consumer groups, and regulators."

Some of those regulators and privacy advocates cited by Cullen include the Article 29 Working Party, "the group of 27 European national data protection regulators charged with providing advice to the European Commission and other EU institutions on data protection."

The Article 29 Working Party has issued guidelines in the past for protecting users' personal data online. Specifically, the group has asked search engine providers to limit the amount of time that they retain IP addresses and other search data.

"Search engines fall under the EU Data Protection Directive 95/46/EC if there are controllers collecting users' IP addresses or search history information, and therefore have to comply with relevant provisions," the group wrote in a statement released in February 2008.

Cullen also claimed in the posting that, under current Microsoft policy, the company separates search-query data from the account information "that could identify the person who performed the search." After the 18-month mark, Microsoft also apparently deletes the IP address, the "de-identified" cookie ID and any cross-section IDs associated with the query. Within the next 12 to 18 months, though, that IP-deleting mark will be lowered to six months.

"There are many good reasons to retain and review search data," Cullen wrote. "Studying trends in search queries enables us to improve the quality of our results, protect against fraud and maintain a secure and viable business."

As search engines have become more adept at data-mining users' information-ostensibly for improving search results and providing more useful applications-inevitable privacy concerns have arisen from a number of quarters. Google has taken several steps recently to assuage privacy critics, such as providing a summary of application data associated with user accounts.  

But Cullen's mention of the Article 29 Working Party indicates that Bing's latest privacy move is more than Microsoft ceding to generalized privacy concerns; indeed, this adjustment to the user-data deletion date may also be the company attempting to head off a possible complaint from the European Commission.

Microsoft has been anxious to wrap up its legislative and legal entanglements in Europe. In Dec. 2009, the company announced a long-awaited agreement with the European Commission, the law enforcement body of the European Union responsible for antitrust initiatives, over the inclusion of Internet Explorer with Windows. Under the terms of the agreement announced on Dec. 16, Microsoft will install an automatic "ballot screen" that will let Windows users choose between 12 different browsers.

Over the summer of 2009, the European Commission had suggested that Windows 7 might have to ship in Europe without Internet Explorer 8 installed. Anxious to avoid having to produce a separate version of its flagship operating system for Europe, Microsoft suggested the ballot screen, which is due to go into effect in mid-March 2010.

The European Commission and Microsoft have historically had a contentious relationship, with the governmental body fining Redmond some $631 million in 2004 for allegedly monopolistic business practices. After that amount of drama, Microsoft may be anxious to avoid any legislative issues with Bing, which managed to incrementally grow its market-share since launching in summer 2009.