Monday, 14 June 2010

Google, Microsoft, Yahoo - search data retention periods table

For convenience, here's the current position on the main search engines' retention and deletion or "anonymization" of search query data, extracted from my much longer blog setting out the history of the discussions between the main search engines and EU data protection regulators (and explaining IP addresses and the last octet, cookies and hashing).

The EU regulators, i.e. Article 29 Working Party, ideally want all personal data related to search queries to be deleted (or rendered fully and effectively anonymous) after 6 months. They want more info on the hashing techniques used, which should be independently audited, before they can be satisfied as to their effectiveness to anonymise personal data. And, of course, hashing or substitution of other identifiers doesn't stop searches from being linked across sessions to the same person or at least same computer or browser.

If anyone has more up to date info on the following, please let me know.

Search data retention periods

IP addresses



Google Last octet only of IP address is deleted after 9 months. (As mentioned previously, that's like deleting the building number from a street address where 255 other people live on the same street) 18 months Not clear if cookies are deleted or hashed after 18 months. Probably deleted.
Microsoft Deleted after 6 months Hashed possibly immediately after search, but it seems certainly after 6 months (registered users) or 18 months (unregistered users).

Deleted after 18 months.
Other cross session identifiers are deleted after 18 months
Yahoo Deleted after 90 days (i.e. 3 months) 1-way secret hash applied to cookies of unregistered users (and to registration identifiers of registered users; then 50% of the hashed registration identifiers deleted or truncated. Not clear exactly when cookies are hashed - probably only after 90 days, rather than immediately after the search?

©WH. This work is licensed under a Creative Commons Attribution Non-Commercial Share-Alike England 2.0 Licence. Please attribute to WH, Tech and Law, and link to the original blog post page. Moral rights asserted.