Microsoft cuts time Bing stores some user data to six months

IDG News Service - Microsoft announced plans to cut the length of time it stores IP addresses of Web searchers using its Bing search engine from 18 months to six in a bid to improve its privacy track record.

Rival Google cut retention times to nine months from 18 in August 2008.

However, Microsoft executives said Tuesday that their initiative goes much further than Google did, because Microsoft will delete all parts of the IP (Internet Protocol) address after six months, while Google still retains part of the address after its self-imposed nine-month cut-off point.

It will take Microsoft between 12 and 18 months to introduce the new tighter data retention policy, it said in a blog posting.

Both companies are responding to pressure from European data protection officials, who are concerned about the privacy implications of retaining an IP address.

The Article 29 committee, comprising data protection officials from all 27 E.U. countries, has asked the leading search engine makers to respond to their concerns by the end of this month.

IP addresses cannot positively identify the person sitting at a computer or accessing the Net via their phone, but they can identify the computer or phone being used, and the hardware can often be linked to a person.

Microsoft and Google both argue that the less data the search engine has, the less well the search engine can respond to a person's specific needs. They also point out that keeping search data helps them combat Internet fraud and spam.

However Brendon Lynch, Microsoft's director of privacy policy, said the Bing search experience won't be compromised by the reduction to a six-month retention time.

"Quality of search won't be reduced but privacy will be enhanced," he said.

John Vassallo, Microsoft's VP for E.U. affairs and its associate general counsel urged rival search companies and in particular the largest search provider, Google, to follow suit in further reducing retention times.

"There should be a common standard across the industry. The largest search provider collects more data than anyone else. We think it is critical that the market leader matches this," Vassallo said.

Google said it will soon submit a written response to the Article 29 committee, but it won't change its nine-month retention policy.

"We're committed to using data to both improve our services and our security measures for our users and protect their privacy, and we remain convinced that our current logs retention policy represents a responsible balance," said Google's global privacy counse, Peter Fleischer, in a statement.