In reversal, Yahoo will store user search data longer

Computerworld - In a move that is unlikely to win it any new friends in the privacy community, Yahoo has announced that it will retain consumer search data for a substantially longer period of time than it does today.

Starting sometime in mid-July, Yahoo will hold raw search log file data, including IP addresses, cookies and search-related information, for up to 18 months. It currently retains such data for 90 days.

Yahoo's chief trust officer, Anne Toth, said in a blog post that the change, announced on Friday, was designed to give consumers a more robust and personalized search experience while also bringing Yahoo into closer alignment with industry-wide data retention norms.

"We will hold raw search log files for 18 months and we will be closely examining what the right policy and time frame should be for other log file data," Toth wrote. "In announcing this change, we have gone back to the drawing board to ensure that our policies will support the innovative products we want to deliver for our consumers."

Toth's announcement marks an abrupt reversal of Yahoo's current data retention policy which it put in place in 2008. Under its current policy, Yahoo stores most log file data for just 90 days, though in some cases the company holds raw data for as long as six months for what it calls fraud and security purposes, and to comply with legal requirements.

In contrast, Google stores search data for nine months, while Microsoft retains it for six months.

When Yahoo announced the policy in 2008, the company noted that its goal was to be able to minimize data retention while also being able to offer a highly personalized experience for users.

While the company's goals remain the same, the Internet has changed and so has Yahoo's business and its competition, Toth said. As a result of these changes "we are moving to align our log file data retention policy closer to the competitive norm across the industry," Toth said.

Yahoo's announcement comes just two months after the U.S. Department of Justice and an organization representing police chiefs from around the country called for legislation mandating Internet Service Providers retain certain customer usage data for as long as two years.

Jim Harper, director of information policy studies at the Cato Institute, a libertarian-leaning public policy research organization, said there's nothing to indicate that Yahoo's immediate move was the result of any government pressure. Instead, the move appears to be have been driven purely by competitive pressures.

He said it would be up to consumers to decide if it is something that is appropriate or not.

At the same time, companies such as Yahoo and Google are coming under increasing pressure from governments in the U.S. and the EU to store all sorts of data for law enforcement purposes, Harper noted.

"I am quite concerned about governments using online services of all kinds as data sources," Harper said. "I tend to worry about the lengthening of data periods."

"Once they are fully tapped into online services and start using them as an ongoing source of information," it will be near impossible to reverse the trend, he said.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com.

Read more about Privacy in Computerworld's Privacy Topic Center.