Yahoo adopts new policy on tracking use

Web company shortens time it will keep records

WASHINGTON - Yahoo Inc. said yesterday it will shorten the amount of time it retains data about its users' online behavior - including Internet search records - to three months from 13 months and expand the range of data that it "anonymizes" after that period.

The new privacy policy comes amid mounting concerns among regulators and lawmakers from Washington to Europe about how much data Internet companies are collecting on users and how that information is being used. Yahoo's decision also ratchets up the pressure on rivals Google Inc. and Microsoft Corp. to follow its lead.

In September, Google said it would "anonymize," or mask, the numeric Internet Protocol addresses on its server logs after nine months, down from 18 months. And Microsoft, which keeps user data for 18 months, said last week it would support an industry standard of six months.

Under Yahoo's new policy, the company will strip out portions of users' IP addresses, alter small tracking files known as cookies, and delete other potential personally identifiable information after 90 days in most cases. In cases involving fraud and data security, the company will anonymize the data after six months.

Yahoo also said it will expand the scope of data that it anonymizes to encompass not only search engine logs, but also page views, page clicks, ad views, and ad clicks. That information is used to personalize online content and advertising.

Yahoo will begin implementing the new policy next month and says it will be effective across all company services by mid-2010.

Anne Toth, vice president of policy and head of privacy for Yahoo, said the company is adopting the policy to build trust with users and differentiate it from competitors. Yahoo also hopes to take the issue of data retention "off the table" by showing that Internet companies can regulate themselves, Toth said.

European Union regulators have pressured Yahoo, Google, and Microsoft over the past year to shorten the amount of time they hold onto user data. And Congress has begun asking questions about the extent to which Internet and telecommunications companies track where their users go online and use that information to target personalized advertising.

Representative Edward Markey, a Massachusetts Democrat and chairman of the House Energy and Commerce Subcommittee on Telecommunications and the Internet, praised Yahoo for setting a new standard on privacy protection and said Google, Microsoft, and other companies will now be compared against that standard.

Ari Schwartz, vice president of the Center for Democracy & Technology, a civil liberties group, agreed that Yahoo's new policy is a "step in the right direction." He added, however, that he would like to see more clarity - and more standardization - from the industry about what it does with Internet users' data. He noted, for instance, that while some companies delete full IP addresses, other delete only parts of IP addresses.

Indeed, Redmond, Wash.-based Microsoft said the method of anonymization is more important than how long records are logged. It called on the entire industry to adopt a "high standard."