Friday, December 19, 2008

Yahoo Slashes Data Retention to Three Months

In a move to one-up its search-engine rivals, Yahoo on Wednesday announced a new global data-retention policy that far surpasses what Google and Microsoft have proposed.

Indeed, Yahoo is setting the industry standard for data retention with its promise to anonymize user log data within 90 days -- with limited exceptions for fraud, security and legal obligations. Yahoo is also expanding its policy to apply not only to search-log data but also page views, page clicks, ad views, and ad clicks.

"In our world of customized online services, responsible use of data is critical to establishing and maintaining user trust," said Anne Toth, Yahoo's vice president of policy. "We know that our users expect relevant and compelling content and advertising when they visit Yahoo, but they also want assurances that we are focused on protecting their privacy."

Yahoo Gets Aggressive

Privacy advocates, including European Union regulators, have put pressure on search engines to slash data-storage times. The current industry standard is 18 months. Microsoft last week told European regulators it's ready to cut the time it holds users' search data from 18 months to six months -- if other search-engine companies do the same.

"What we've done since April is evaluate the multiple uses of search data to ascertain if we can, in time, move to a six-month time frame," said Peter Cullen, Microsoft's chief privacy strategist. "Our answer is yes, we can, but we don't believe it makes sense for us to make this change until our competitors also commit to meeting this higher standard with respect to both the method and time frame for anonymization."

Yahoo isn't waiting for other search engines to cooperate. Instead, the heads of the business and engineering units at Yahoo worked with the privacy and data-governance teams to review data needs. Their goal was to ensure that Yahoo retains data only long enough to serve its business and user-experience needs while maintaining the ability to fight fraud, secure systems, and meet legal obligations.

"This policy represents Yahoo's assessment of the minimum amount of time we need to retain data in order to respond to the needs of our business while deepening our trusted relationship with users," Toth said. "We're proud this new policy sets a new benchmark for the industry."

What Will Google Do?

Yahoo said users won't see a difference in their experience with Yahoo products or services, and advertisers will continue to leverage its interest-based advertising systems to deliver the most relevant ads. That revelation begs the question: Do users really care how long search engines retain their search data?

"I question to what extent consumers have any awareness of data-retention issues," said Greg Sterling, principal analyst at Sterling Market Intelligence. "They do have awareness that their behavior is tracked online, and there is considerable discomfort with that, but in terms of specific issues as to how long data is kept, I think there is total ignorance on the part of regular consumers."

Yahoo's move also begs questions about what Microsoft, Google and others will do in response to this aggressive policy. Sterling said it puts pressure on the search-engine industry to at least shave time off their data-retention policies. The European Union has pushed for a six-month limit.

"We might see Microsoft quickly come out and say it will cut its policy to six months, or maybe match Yahoo," Sterling said. "If that happens, certainly Google will have to follow suit. Google may not come down to three months, but they may come down to six months. If Google were to be isolated in this, it would not only incur the wrath of the EU regulators but it would also suffer in the press as the other two key players stepped up to the requested standard."

Wednesday, December 17, 2008

Privacy Proponents Prompt President-Elect To Police

Privacy advocates met Tuesday with members of President-elect Barack Obama's Federal Trade Commission transition team to urge that the government more aggressively regulate the online advertising industry.

"The overall message was that the Bush FTC gets an 'F' on privacy," said Jeff Chester, executive director of the Center for Digital Democracy. "We're expecting the Obama team to take a better approach."

Chester, who two years ago filed a complaint with the FTC about online behavioral targeting, is pressing for new laws that would require marketers to seek Web users' permission before tracking them for ad purposes.

Other groups at the one-hour meeting Tuesday with FTC transition team heads Susan Ness and Phil Weiser included the ACLU, Consumer Federation of America, Electronic Frontier Foundation, and World Privacy Forum.

Online ad executives and the Interactive Advertising Bureau have argued that the FTC should not restrict behavioral targeting because the practice does not harm consumers. Ad companies also say that behavioral targeting is often anonymous because they don't collect names, addresses or other so-called personally identifiable information. Instead, companies track users anonymously via cookies as they go from site to site, compile profiles, and then serve ads to users based on their presumed interests.

But privacy advocates have questioned just how anonymous this type of targeting really is. They say that in some circumstances, it might be possible to identify specific individuals from detailed profile information.

In addition, some consumer advocates say behavioral targeting is inherently problematic.

"Behavioral tracking and targeting is actually deceptive on its face because consumers' information is being collected by entities with whom they have no relationship, to whom they didn't give their information, and for purposes of which they're unaware," said Susan Grant, director of consumer protection at the Consumer Federation of America.

Grant added that her organization was concerned that some consumers could face tangible consequences due to behavioral targeting. For instance, she said, companies could potentially use information gleaned from tracking people online to make different offers to different people.

Some of the advocates also criticized the Network Advertising Initiative's new privacy guidelines to the transition team. Pam Dixon, executive director of the World Privacy Forum, said those standards don't adequately protect the privacy of people's medical information.

"To say they're non-starters is an understatement," Dixon said.

The new NAI guidelines call for ad companies to refrain from collecting data about sensitive medical information or serving ads related to such information, unless consumers expressly consent. The prior guidelines said marketers should never collect such data if it was personally identifiable, but allowed them to do so if the information was anonymous and people could opt out.

Google Wants Its Own Fast Track on the Web

The celebrated openness of the Internet -- network providers are not supposed to give preferential treatment to any traffic -- is quietly losing powerful defenders.

Google Inc. has approached major cable and phone companies that carry Internet traffic with a proposal to create a fast lane for its own content, according to documents reviewed by The Wall Street Journal. Google has traditionally been one of the loudest advocates of equal network access for all content providers.

At risk is a principle known as network neutrality: Cable and phone companies that operate the data pipelines are supposed to treat all traffic the same -- nobody is supposed to jump the line.

But phone and cable companies argue that Internet content providers should share in their network costs, particularly with Internet traffic growing by more than 50% annually, according to estimates. Carriers say that to keep up with surging traffic, driven mainly by the proliferation of online video, they need to boost revenue to upgrade their networks. Charging companies for fast lanes is one option.

One major cable operator in talks with Google says it has been reluctant so far to strike a deal because of concern it might violate Federal Communications Commission guidelines on network neutrality.

"If we did this, Washington would be on fire," says one executive at the cable company who is familiar with the talks, referring to the likely reaction of regulators and lawmakers.

Separately, Microsoft Corp. and Yahoo Inc. have withdrawn quietly from a coalition formed two years ago to protect network neutrality. Each company has forged partnerships with the phone and cable companies. In addition, prominent Internet scholars, some of whom have advised President-elect Barack Obama on technology issues, have softened their views on the subject.

The contentious issue has wide ramifications for the Internet as a platform for new businesses. If companies like Google succeed in negotiating preferential treatment, the Internet could become a place where wealthy companies get faster and easier access to the Web than less affluent ones, according to advocates of network neutrality. That could choke off competition, they say.

For computer users, it could mean that Web sites by companies not able to strike fast-lane deals will respond more slowly than those by companies able to pay. In the worst-case scenario, the Internet could become a medium where large companies, such as Comcast Corp. in cable television, would control both distribution and content -- and much of what users can access, according to neutrality advocates.

The developments could test Mr. Obama's professed commitment to network neutrality. "The Internet is perhaps the most open network in history, and we have to keep it that way," he told Google employees a year ago at the company's Mountain View, Calif., campus. "I will take a back seat to no one in my commitment to network neutrality."

But Lawrence Lessig, an Internet law professor at Stanford University and an influential proponent of network neutrality, recently shifted gears by saying at a conference that content providers should be able to pay for faster service. Mr. Lessig, who has known President-elect Barack Obama since their days teaching law at the University of Chicago, has been mentioned as a candidate to head the Federal Communications Commission, which regulates the telecommunications industry.

The shifting positions concern some purists. "What they're talking about is selling you the right to skip ahead in the line," says Ben Scott, policy director of Free Press, a Washington-based advocacy group. "It would mean the first part of your business plan would be a deal with AT&T to get into their super-tier -- that is anathema to a culture of innovation."

Advocates of network neutrality believe it has helped the Internet drive the technology revolution of the past two decades, creating hundreds of thousands of jobs.

The concept of network neutrality originated with the phone business. The nation's longtime telephone monopoly, nicknamed Ma Bell, and its regional successors were prohibited from giving any public phone call preference in how quickly it was connected. When the Internet first boomed in the 1990s, content largely traveled via telephone line, and the rule survived by default.

'Dumbpipes'

The carriers picked up the unflattering nickname "dumbpipes," underscoring their strict noninterference in the Internet traffic surging over their networks. The name heightened resentment among the carriers toward the soaring wealth of the content providers, such as Amazon.com Inc., that couldn't exist without the networks of the telecom and cable companies.

In August 2005, amid a deregulatory environment, the FCC weakened network neutrality to a set of four "guiding principles." The step had the effect of making the FCC's power to enforce network neutrality subject to interpretation, emboldening those looking for ways around it.

Stirring the waters further, major phone companies including AT&T and Verizon announced they intended to create new fast lanes on the Internet -- and would charge content companies a toll to use it. They claimed Internet companies had been getting a free ride.

That unleashed a firestorm of criticism. A diverse group including Internet companies Google, Microsoft and Amazon joined the likes of the Christian Coalition, the National Rifle Association and the pop singer Moby in what they characterized as a fight to "save the Internet." The coalition claimed such steps could endanger freedom of speech.

Advocates of network neutrality also claimed that dismantling the rule would be the first step toward distributors gaining control over content, since they could dictate traffic according to fees charged to content providers. The fortunes of a certain Web site, in other words, might depend on how much it could pay network providers, rather than on its popularity.

That concern would grow if the carriers themselves offer content, which some have tried, with mixed success. AT&T, the country's largest broadband provider, recently launched its own online video service, called VideoCrawler, to compete with YouTube and others.

"One way AT&T can win that competition is to give their own video service preferential treatment on their network," says Robert Topolski, a networking engineer based in Portland, Ore. An AT&T spokesman says the company has no plans to give VideoCrawler preferential treatment on its network.

Mr. Topolski discovered that Comcast was slowing a video file-sharing service called BitTorrent. That discovery eventually led to sanctions against Comcast by the FCC. Comcast has appealed the decision, arguing the FCC did not have the authority to make such a ruling.

In 2006, Microsoft felt strongly enough about the issue that it wrote Congress to declare that saving network neutrality "could dictate whether the U.S. will continue to lead the world in Internet-related technologies."

The debate eventually reached a stalemate. Legislation to codify network neutrality failed to pass, and carriers backed off their plans for a tiered Internet.

During his presidential campaign, Mr. Obama spoke frequently about the Internet, which was a critical tool in his grass-roots effort to reach new voters, and the importance of network neutrality. "Once providers start to give privilege to some Web sites and applications over others, then the smaller voices get squeezed out," he told Google employees a year ago when he campaigned at the company. "And then we all lose."

Obama Advisers

But some of those who advise the new president on technology have changed their view on network neutrality. Stanford's Mr. Lessig, for one, has softened his opposition to variable service tiers. At a conference, he argued that carriers won't become kingmakers so long as the faster service at a higher price is available to anyone willing to pay it.

"There are good reasons to be able to prioritize traffic," Mr. Lessig said later in an interview. "If everyone had to pay the same rates for postal service, than you wouldn't be able to differentiate between sending a greeting card to your grandma versus sending an overnight letter to your lawyer."

Some telecom experts say that broadband is the most profitable service offered by phone and cable companies, and they are simply trying to offset declining revenue from their traditional phone business.

In the two years since Google, Microsoft, Amazon and other Internet companies lined up in favor of network neutrality, the landscape has changed. The Internet companies have formed partnerships with phone and cable companies, making them more dependent on one another.

Microsoft, which appealed to Congress to save network neutrality just two years ago, has changed its position completely. "Network neutrality is a policy avenue the company is no longer pursuing," Microsoft said in a statement. The Redmond, Wash., software giant now favors legislation to allow network operators to offer different tiers of service to content companies.

Microsoft has a deal to provide software for AT&T's Internet television service. A Microsoft spokesman declined to comment whether this arrangement affected the company's position on network neutrality.

Amazon's popular digital-reading device, called the Kindle, offers a dedicated, faster download service, an arrangement Amazon has with Sprint. That has prompted questions in the blogosphere about whether the service violates network neutrality.

"Amazon continues to support adoption of net neutrality rules to protect the longstanding, fundamental openness of the Internet," Amazon said in a statement. It declined to elaborate on its Kindle arrangement.

Amazon had withdrawn from the coalition of companies supporting net neutrality, but it recently was listed once again on the group's Web site. It declined to comment on whether carriers should be allowed to prioritize traffic.

Yahoo now has a digital subscriber-line partnership with AT&T. Some have speculated that the deal has caused Yahoo to go silent on the network-neutrality issue.

An AT&T spokesman said the company should be able to strike any deal it sees fit with content companies. Yahoo said in a statement that carriers and content companies "should find a consensus on how best to ensure that Americans have access to a world-class Internet."

Google Connections
Google, with its dominant market position and its perceived ties to the Obama team, may hold the most sway. One of President-elect Obama's most visible supporters during the campaign was Eric Schmidt, Google's chief executive officer. Mr. Schmidt remains an adviser during the transition.


Eric Schmidt
Google's proposed arrangement with network providers, internally called OpenEdge, would place Google servers directly within the network of the service providers, according to documents reviewed by the Journal. The setup would accelerate Google's service for users. Google has asked the providers it has approached not to talk about the idea, according to people familiar with the plans.

Asked about OpenEdge, Google said only that other companies such as Yahoo and Microsoft could strike similar deals if they desired. But Google's move, if successful, would give it an advantage available to very few.

The matter could come to a head quickly. In approving AT&T's 2006 acquisition of Bell South, the FCC made AT&T agree to shelve plans for a fast lane for 30 months. That moratorium expires in the middle of next year. A Democratic lawmaker has already promised new network-neutrality legislation early in 2009. And a new chairman of the FCC could take a stricter position on forcing companies to comply with network neutrality.

Richard Whitt, Google's head of public affairs, denies the company's proposal would violate network neutrality. Nevertheless, he says he's unsure how committed President-elect Obama will remain to the principle.

"If you look at his plans," says Mr. Whitt, "they are much less specific than they were before."

Thursday, December 11, 2008

Center For Democracy Calls For New Privacy Laws

The Center for Democracy & Technology has issued its wish list for the Obama administration and, high on the agenda, is a call for new privacy laws.

"President Obama should work with Congress to enact a comprehensive, technology-neutral consumer privacy law establishing meaningful safeguards for the personal information that companies collect from consumers," the document states. "Such a law should be broad enough to protect American consumers both online and in the 'brick and mortar' world."

The Center for Democracy & Technology's document is quite broad -- deliberately so, to leave room for interested parties to weigh in on the specifics.

Even so, the organization begs the critical question of what, exactly, constitutes "personal information." For years, many online ad executives involved in behavioral targeting or analytics have said they don't deal in "personally identifiable information" because they aren't collecting users' names, addresses, email addresses or telephone numbers. Therefore, Web execs argue, behavioral targeting and/or analytics companies don't need to obtain people's explicit consent before collecting data.

But the reality is that people can be identified even without so-called "personally identifiable information." For instance, it's possible to deduce a computer user's identity by looking at all of the searches originating at that computer -- as the world learned when AOL released search queries of 650,000 "anonymous" users. Within days of the data breach, The New York Times identified one AOL user based on her search history and ran front-page story about her.

If there's going to be new legislation addressing privacy, one of the first orders of business should be shedding old definitions of "personally identifiable information" and coming up with new standards setting out what types of personal information will be protected.

Tuesday, December 2, 2008

Delete Cookies, Says New Privacy Forum

The AT&T-backed think tank Future of Privacy Forum has launched its first initiative: a campaign warning consumers how search engines store their queries and marketers use online cookies.

"You may not be aware that when you visit a site you're actually a part of a complex advertising and marketing mechanism," the group cautions. "Very few things on the Internet are completely anonymous."

The group goes on to instruct people about options to enhance privacy. The advice includes directives to delete cookies and use Microsoft's Internet Explorer 8 browser -- which includes a feature that can block the cookies that track users across sites for ad-serving purposes. The organization also suggests that searchers use IAC's Ask Eraser, which deletes some log files tying search queries to IP addresses.

With these recommendations, the group appears to be setting itself up as close to the polar opposite of industry organizations like Safecount or the Network Advertising Initiative. Safecount, founded in 2005 in response to reports that users routinely deleted cookies, touted their benefits. "Cookies help advertisers understand if their ads are working, and they help researchers make accurate counts through the surveys they invite you and other consumers to participate in. ... In most cases, it's this advertising that enables us all to visit and access our favorite websites for free," Safecount says on its site.

Additionally, AT&T has gone on record as favoring an opt-in model to behavioral advertising, or serving ads to people based on their Web-surfing activity. The company not only says it intends to require opt-in consent for behavioral targeting, but also believes all companies should obtain users' explicit consent before tracking them online. This stance is at odds with groups like the Network Advertising Initiative or Interactive Advertising Bureau, which typically call on companies to notify users about tracking and allow them to opt out.

Separately, while the Future of Privacy Forum, hasn't mentioned Google by name, it's becoming increasingly clear that the think tank is no fan of the world's largest search engine. This stance isn't a huge surprise when you consider the group is backed by AT&T -- which, like other ISPs, has been at odds with Google about both net neutrality and privacy.

In general, network operators say they should be able to decide how to manage traffic, while Google is one of the biggest advocates of net neutrality, or the principle that ISPs should treat all traffic equally. Some ISPs, like Verizon, have made it clear they specifically resent Google profiting off of Web visits they enable.

Privacy advocates in general have criticized Google for its decision to store IP logs tying search queries to specific IP addresses. Among other reasons, there's a concern that Google would combine records about search activity with information gleaned from other sources about which Web sites people visit to create profiles that would be used for marketing purposes.

The Future of Privacy Forum suggestion that searches use Ask.com's Ask Eraser indicate that it, too, isn't happy about the sheer quantity of data that Google has on hand about Web users. If nothing else, the recommendation seems designed to intensify scrutiny of the company and its data collection practices.