Google amends log retention rules, privacy advocates respond |
 |
By Robert Westervelt, News Editor
09 Sep 2008 | SearchSecurity.com |
|
|
Search engine giant Google Inc. is cutting in half its 18-month log retention policy, in a move it says will address regulatory concerns and boost privacy for end users.
|
|
|
|
|
I think users should be made aware of the truth, which is that they are being scrutinized closely.
Grayson Barber,
First Amendment attorney and privacy advocate, Princeton University
|
|
|
|
|
|
|
|
|
|
Google said it will make IP addresses associated with server logs anonymous after nine months. The Mountain View, Calif.,-based company also filed a brief with European Union (EU) privacy regulators to explain its logs retention policy.
"After months of work our engineers developed methods for preserving more of the data's utility while also anonymizing IP addresses sooner," Google said in its Official Google Blog.
Grayson Barber, a First Amendment attorney and privacy advocate, said the length of time log records are kept before they are anonymized is not necessarily the issue.
"It is about the quality of 'anonymization,'" Barber wrote in an email exchange. "If the records are truly anonymized, the change in timeframe is good news."
"If clickstreams and other search data can be analyzed to reveal confidential information about individuals, disclosures carry more voltage after 9 months than they would be after 18 months. The key is to limit the personally identifiable information effectively with real anonymization."
In a brief to the EU, Google explained that it collects IP addresses with search information to deliver relevant ads to users and defend against click fraud. The company said it is not interested in identifying unregistered users. Google said its search logs are also used to weed out irrelevant websites called webspam that cheat their way into relevant positions in search results.
"The problem is difficult to solve because the characteristics of the data that make it useful to prevent fraud, for example, are the very characteristics that also introduce some privacy risk," Google said.
Kevin Bankston, a senior staff attorney at the Electronic Frontier Foundation called the new retention policy a step forward for Internet privacy, "but the details matter, and as Google itself has admitted, it's still trying to figure out exactly how it will anonymize the data."
Bankston said it is also unclear whether Google satisfied Article 29 of the EU Working Group's opinion on search engine privacy. Article 29 restricts retention of personal data to six months or the search engine must demonstrate that it is necessary for the service.
"Although Google's written response provides a decent summary of the reasons why they retain the data, I wouldn't say that it comprehensively demonstrates that it is strictly necessary for Google to retain the data for nine months rather than six," Bankston said.
Google first amended its privacy policy in 2007 after critics pointed out that the search engine giant was collecting and retaining too much data on user searches. At the time the company said it would anonymize its server log data after 18-24 months.
Privacy advocates agree that it comes down to the quality of Google's "anonymization" and education of consumers. Many consumers are unaware of what happens when they use Google, Barber said.
"I think users should be made aware of the truth, which is that they are being scrutinized closely," Barber said. "This means Google should be very clear about the way it treats all the information it gathers."
|
