Search Privacy

I Know What You Searched For Last Summer

If you are logged into a Google Account, then YES, everything you search for with Google will be logged in your Web History. If you don't have a Google Account, or if you're not logged into it, no search data will be logged. If you use Google services such as Gmail, Picasa, iGoogle, Google Groups, or Adwords, then you already have a Google Account.

Although it sounds a little scary, Google's Web History feature does have some interesting features. You can use it to review all your previous searches, and the websites you've visited. You can also search the full text of pages you've visited. Your Web History is private, and Google will not disclose this information to any third parties.

If you're uncomfortable with this, you can delete your Web History and turn this feature off. To do so, log into your Web History account, click Remove items, then click the Clear entire Web History link.

Other popular search providers such as Yahoo, Microsoft and AOL do not claim (or admit?) that they log search history on a per-user basis, but they all log search data on an aggregate level. By aggregate, I mean they keep a log that includes IP addresses and search terms, but they do not store information that could be used to associate searches with specific users or accounts.

It's possible that, given an IP address and a list of search terms, someone could guess at the identity of the searcher. These search history logs are protected by each provider's privacy policy, which is supposed to prevent the release of this data to the unwashed masses. But that doesn't mean it will never happen. Back in 2006, AOL accidentally released 20 million search queries gathered randomly from 658,000 AOL users over a three month period. Researchers had a field day with the data, and speculated about the identities of some of the searchers represented by the data.

Some search providers (notably Google and Microsoft) have promised to anonymize search data after 18-24 months by obfuscating IP addresses, removing cookies and other identifiers from search terms. To the best of my knowledge, there is no way to completely opt out of logging when you use a search engine, unless you use an anonymizer when surfing.

Oh, and don't confuse search history with browser history. Completely separate from whatever logging and tracking is happening at the search engines, your browser also keeps a list of the search queries you type in. See Clearing Browser History for more information on how to delete your search tracks.

Who Else is Watching?

Everything you search for, every website you visit, even the emails you send and receive, all pass through your Internet Service Provider's servers when you use the Internet. They have the entire picture -- not just your searches at one particular search engine. And because you are their customer, the ISP is in a unique position to connect your IP address to your name and physical location.

However, ISP tracking logs only are retained until they are no longer needed for business purposes like billing disputes and marketing research. User data logs can also be retained by Internet Service Providers under the 1996 Electronic Communication Transactional Records Act for an additional 90 days if requested by a governmental agency. While not ideal for the user, these record retention policies are controlled and they have well defined limitations that are designed to protect the user's privacy.

But there's always the human factor. Someone has to have access to those logs. We hear all the time about medical workers who peek into private records and leak sordid celebrity details to slimy reporters. What about the sysadmin with too much time on his hands?

Uncle Sam Wants a Peek

Unfortunately, the FBI and some members of congress are trying to pass legislation that would require all ISPs to keep user logs for up to two years. If passed, this law could mandate a record of what websites people visit each day, what emails they send and what IMs they send. The problem with the current draft of this bill is that it does not specify what user information will be retained, who will have access to it or how the information can be used. It seems that with the amount of attention web data tracking is receiving by the federal government, it will only be a matter of time before some form of Internet user tracking law is passed.

In a world that runs on data, search privacy is an important issue. Right now there are few regulations that are protecting internet users from data tracking and mining, as even the federal government is trying to keep tabs on where web surfers are going online. The only protection web users have is knowledge about search privacy and opt out strategies. Using both of these protective devices, web users can create at least a modest layer of privacy protection for their web activities.

Do you have comments or questions about search privacy? Post your thoughts below...