Benchmarking Search Engines' Privacy

Over their relative short history, Internet search engines have emerged as the de facto gateway to the rest of the World Wide Web. As a result, search engines have come to strongly influence (and at times, almost control) users' access to information. In almost every country around the world today, Internet search engines occupy the top ranking in terms of page views and user reach.

But how do Internet search engines fare with respect to protecting their users' privacy? Unfortunately, not very well. Based on two recent studies, the first conducted in 2007 by Privacy International (a nonprofit, nongovernmental organisation based in London), and the second conducted in 2008 by CNET (an online technology media company owned and operated by CBS, a for profit company headquartered in New York), the leading search engines rank close to the bottom on key privacy measures.

I. The Privacy International 2007 Study

In 2007, Privacy International conducted a landmark study that examined privacy practices of leading Internet companies and search engines. Privacy International conducted exhaustive research on the policies and activities of Google, Microsoft, AOL, and Yahoo! and compared them with other leading Internet companies. The overall assessment was alarming: the leading global search engines were at worst, explicitly hostile to privacy, and at best, suffered from significant privacy lapses.

Privacy International's specific evaluations were as follows:

Hostile to Privacy

Google was judged by Privacy International as not only the worst search engine with respect to privacy, but also the worst of all major Internet properties overall. In declaring Google to be "hostile to privacy," Privacy International cited its track history of "ignoring privacy concerns, possibly deceptive privacy policy, and generally poor track record of responding to customer complaints."

Privacy International also expressed concern at the sheer volume of information Google has about each user, not only through searches, but also such activities as email, chat, blogging, and use of maps. Privacy International also worried about the implications of Google's acquisition of  Doubleclick, a company that has been fined repeated for its misleading privacy practices

Substantial Threats to Privacy

Both Yahoo and AOL were assessed by Privacy International as posing substantial threats to privacy.Privacy International cited AOL's and Yahoo's history of sharing data with governments both in the U.S. and China. Privacy International also reported that Yahoo's "vague privacy policy" prevented users "from understanding the dynamics of data processing" and that AOL displayed no apparent interest in privacy enhancing innovations.

Privacy Lapses

Microsoft was deemed by Privacy International as showing some privacy lapses but not posing a substantial threat to privacy. Privacy International cited Microsoft's "improved level of responsiveness to privacy concerns and customer feedback" and further noted that "privacy has now been embedded throughout all stages of the design process for Microsoft products."

Nevertheless, Privacy International also expressed concern that Microsoft did not reveal more information on data retention, and that Microsoft's privacy policy was too basic to cover the full scope of potential abuse.

II. The CNET 2008 Survey

In late 2008, CNET conducted a related survey designed to revisit and document the privacy policies of the leading Internet search engines. They evaluated such factors as how long the leading search engines keep their users' personal data, whether this data is subsequently deleted completely, whether the search engines engage in behavioural targeting, and whether such behavioral targeting is a mandatory requirement for full use of the search engine.

Once again the results were sobering. Among the major search engines also evaluated by Privacy International (Google, Microsoft, Yahoo and AOL), Google once again fared the worst in the CNET survey. According to CNET, Google kept user data for 18 months, and even afterwards did not fully delete this data. AOL, surprisingly, fared better. According to the survey, AOL had revamped its privacy policies significantly, and now only kept user data for 13 months and fully deleted them afterwards.

III. Recent Developments and IPF Recommendations

Since the publications of the Privacy International and CNET surveys and continued pressure from the public, the media, and government agencies, the leading Internet search engines have begun to take tentative steps toward greater protection of their users’ privacy. Unfortunately, we at the International Privacy Forum believe that these four players still have a long way to go.

So what is an Internet user to do? Given the sheer importance and influence of Internet search engines today, the IPF recognises that it would be impractical for users to refrain from using any search engine whatsoever. Instead, the IPF recommends the following:

 Move to Top