There are times when working on privacy issues resembles nothing more than a game of whack-a-mole: no sooner do you respond to one abusive practice or questionable business model than another one comes out of the woodwork. It can get a little bit depressing, which made it particularly gratifying this month to be able to report some modest progress in the ongoing effort to give consumers greater control of their personal information.
Responding to public concern and regulatory pressure in the United States and abroad, the major search companies appear to be starting to seriously compete with one another over how well they protect their customers' privacy. In the past few months, the five largest Internet search providers have announced significant changes to how they handle the stored records of Internet searches, including deleting old user data, stripping the personally identifiable information out of stored search records, and, in one case, giving users the option to have all of their search records deleted.
Last week,
we published a report that tracks the recent announcements and compares the revamped privacy practices of the five largest search providers.
By themselves, these changes don't represent a tectonic shift in the online privacy landscape, but we're hoping that they do signal the dawn of a new competitive market in which vigorous privacy protection becomes as much a selling point as high-quality service.
As recently as 2005, search wasn't a primary focus of the larger Internet privacy debate. Although many people were aware that every time they searched for something, they were creating a small record that could potentially be tracked back to them, few understood the extent to which that information could be construed as "personally identifiable." Then in August 2006, AOL released the search terms from more than 600,000 users as part of an academic experiment. Although the users in question were given pseudonyms, some enterprising journalists were able to go through the search terms and trace them back to real people.
Seemingly overnight, people began to realize that extensive records of all our searches could be used to paint surprisingly detailed pictures of our lives, preferences and movements. Privacy advocates, government watchdogs and individual users also started asking companies what they were doing to safeguard that information.
The answer, until very recently, was that most search providers kept that information for as long as they deemed it useful -- which generally meant forever. In the past few months, those practices have improved from a privacy perspective -- a compelling illustration of the benefit that the combination of regulatory engagement, pubic outcry and competitive pressure can yield for consumers.
Again, this is only a small step. The truth is that no amount of industry self-regulation can supplant the need for a comprehensive federal privacy law that establishes baseline standards for how companies must treat our personally identifiable information. Solving our online privacy dilemma will take a combination of aggressive educational efforts, intelligent policymaking and a serious commitment by industry to better protect consumers. As it stands we're still a long way from our goal, but these recent announcements seem to be a mark of real progress and we applaud them.