What Search Sites Know About You
By Joanna Glasner |
02:00 AM Apr. 05, 2005 PT
For most people who spend a lot of time online, impulsively typing
queries into a search engine has become second nature.
Got a nasty infection in an embarrassing spot? Look up a treatment
on your favorite search site. Obsessing about an ex? Try Googling
his or her name. Chances are the queries will unearth some
enlightening information.
But while search engines are quite upfront about sharing their
knowledge on topics you enter in the query box, it's not so clear
what they know about you. As operators of the most popular search
engines roll out more services that require user registration,
industry observers and privacy advocates say it's become more
feasible to associate a particular query with an individual.
"You should think about what you put in that search box, because it
may not be as anonymous as you think," said Danny Sullivan, editor
of SearchEngineWatch.com.
It has long been standard practice, Sullivan noted, for search
sites to employ cookies, which track activity on a computer's
internet browser. But cookies don't identify a person by name. If
two people access a site on the same browser, the cookie wouldn't
distinguish between them.
However, when people provide personal information to register for
services offered by search engine companies, such as free e-mail
accounts, news alerts or personalized homepages, they're no longer
anonymous.
"When they're working off a cookie, all they know is it's some
person, at some computer," Sullivan said. "When you register with
Yahoo, then they have personally identifiable information about
you. You're a person who's at least told them that you live in a
certain place, that you're a certain age, et cetera."
Chris Hoofnagle, West Coast director of the Electronic Privacy
Information Center, is particularly wary of Google's growing
dominance in search and its expansion into other areas, like its
free e-mail service, Gmail, and its social-networking website,
orkut.com.
"Many people use Google all day, plus Gmail and orkut," he said.
"It will supplant Microsoft as the company that has its finger on
the infrastructure of our data."
Another worrisome specter for privacy advocates is Google's use of
tracking cookies. According to Hoofnagle, Google's privacy policy
still reserves the right to use a single cookie across product
lines, including web searches, e-mail and other applications.
Google did not deny that cookies can cross product lines but did
not specify how it currently employs the tracking mechanisms.
Daniel Brandt, operator of Google Watch, a site that's critical of
Google, says people who are concerned with privacy should be
particularly cautious about what records are being kept on their
online searches. In many ways, search data is even more valuable
than other information sought by marketers, such as shopping
records.
"I think I'd rather have a list of someone's search terms for the
past 30 days than a list of the books they've read for a year,"
Brandt said. "It tells what someone is thinking at a particular
moment in time. That's very valuable information."
Of course, many people concerned with privacy simply opt to give
false information. This strategy can work, except when you lose
your password and the site won't supply it until you accurately
re-enter your now-forgotten fake name and birthday.
For those worried about having their online activities tracked,
search engines offer some reassurance in their posted privacy
policies.
Google's policy, for example, maintains that its websites "do not
rent or sell your personally identifying information to other
companies or individuals, unless we have your consent."
Ask Jeeves says it requests registrants for its member services to
provide personalized information "so that we can provide
personalized service." The company, which recently agreed to be
acquired by the internet firm IAC/InterActive, says it does not
share information with unrelated third parties not bound by its
privacy policy without consent.
But Jeeves said in a written statement that it is "too soon to be
able to discuss how Ask Jeeves' privacy policy might be affected in
the acquisition by IAC, as the transaction is not yet complete."
The search company said it intends to continue using its current
policy, which is certified by the TRUSTe Privacy Seal
Program.
Yahoo also assures that it does not rent, sell or share personal
data with nonaffiliated companies without users' consent (except in
a few exceptional cases, such as when it receives a
subpoena).
However, Yahoo makes clear that it is keeping close tabs on its
users internally.
"Once you register with Yahoo and sign in to our services, you are
not anonymous to us," its privacy policy states.
Yahoo says it collects personal information when people register
with the site and use its products and services. The company says
it may combine this information with data from business partners or
other companies. It also displays targeted ads based on personal
information.
For active online searchers who want to keep their activities as
anonymous as possible, Sullivan and Hoofnagle say a few steps can
help.
Setting the browser to not accept cookies, Sullivan said, is one
option, although it may result in some sites no longer working.
Another possibility is to surf the internet using an anonymous IP
address, which makes one's movements difficult to track.
Sullivan also recommends logging off free e-mail accounts and other
services that require registration when one is not actively using
them.
Hoofnagle advises that Google users periodically delete the search
engine's tracking cookie. Or, they can set a rule in their cookie
file not to permanently accept the Google cookie in the first
place.
But Hoofnagle is most emphatic on one point: Stay away from Gmail.
While 2 free GB of storage is a tempting offer, it's not worth the
trade-off of having e-mail monitored and scanned.
It's advice Hoofnagle would rather give than take, however. In the
12 months since Google unveiled Gmail, Hoofnagle said he and nearly
every other privacy advocate he knows has signed up for an
account.
Of course, he said, they joined to monitor for invasive privacy
practices, not for the 2 gigs of storage.