02:00 AM Apr. 05, 2005 PT
For most people who spend a lot of time online, impulsively typing queries into a search engine has become second nature.
Got a nasty infection in an embarrassing spot? Look up a treatment on your favorite search site. Obsessing about an ex? Try Googling his or her name. Chances are the queries will unearth some enlightening information.
But while search engines are quite upfront about sharing their knowledge on topics you enter in the query box, it’s not so clear what they know about you. As operators of the most popular search engines roll out more services that require user registration, industry observers and privacy advocates say it’s become more feasible to associate a particular query with an individual.
“You should think about what you put in that search box, because it may not be as anonymous as you think,” said Danny Sullivan, editor of SearchEngineWatch.com.
It has long been standard practice, Sullivan noted, for search sites to employ cookies, which track activity on a computer’s internet browser. But cookies don’t identify a person by name. If two people access a site on the same browser, the cookie wouldn’t distinguish between them.
However, when people provide personal information to register for services offered by search engine companies, such as free e-mail accounts, news alerts or personalized homepages, they’re no longer anonymous.
“When they’re working off a cookie, all they know is it’s some person, at some computer,” Sullivan said. “When you register with Yahoo, then they have personally identifiable information about you. You’re a person who’s at least told them that you live in a certain place, that you’re a certain age, et cetera.”
Chris Hoofnagle, West Coast director of the Electronic Privacy Information Center, is particularly wary of Google’s growing dominance in search and its expansion into other areas, like its free e-mail service, Gmail, and its social-networking website, orkut.com.
“Many people use Google all day, plus Gmail and orkut,” he said. “It will supplant Microsoft as the company that has its finger on the infrastructure of our data.”
Another worrisome specter for privacy advocates is Google’s use of tracking cookies. According to Hoofnagle, Google’s privacy policy still reserves the right to use a single cookie across product lines, including web searches, e-mail and other applications.
Google did not deny that cookies can cross product lines but did not specify how it currently employs the tracking mechanisms.
Daniel Brandt, operator of Google Watch, a site that’s critical of Google, says people who are concerned with privacy should be particularly cautious about what records are being kept on their online searches. In many ways, search data is even more valuable than other information sought by marketers, such as shopping records.
“I think I’d rather have a list of someone’s search terms for the past 30 days than a list of the books they’ve read for a year,” Brandt said. “It tells what someone is thinking at a particular moment in time. That’s very valuable information.”
Of course, many people concerned with privacy simply opt to give false information. This strategy can work, except when you lose your password and the site won’t supply it until you accurately re-enter your now-forgotten fake name and birthday.
For those worried about having their online activities tracked, search engines offer some reassurance in their posted privacy policies.
Google’s policy, for example, maintains that its websites “do not rent or sell your personally identifying information to other companies or individuals, unless we have your consent.”
Ask Jeeves says it requests registrants for its member services to provide personalized information “so that we can provide personalized service.” The company, which recently agreed to be acquired by the internet firm IAC/InterActive, says it does not share information with unrelated third parties not bound by its privacy policy without consent.
But Jeeves said in a written statement that it is “too soon to be able to discuss how Ask Jeeves’ privacy policy might be affected in the acquisition by IAC, as the transaction is not yet complete.” The search company said it intends to continue using its current policy, which is certified by the TRUSTe Privacy Seal Program.
Yahoo also assures that it does not rent, sell or share personal data with nonaffiliated companies without users’ consent (except in a few exceptional cases, such as when it receives a subpoena).
However, Yahoo makes clear that it is keeping close tabs on its users internally.
“Once you register with Yahoo and sign in to our services, you are not anonymous to us,” its privacy policy states.
Yahoo says it collects personal information when people register with the site and use its products and services. The company says it may combine this information with data from business partners or other companies. It also displays targeted ads based on personal information.
For active online searchers who want to keep their activities as anonymous as possible, Sullivan and Hoofnagle say a few steps can help.
Setting the browser to not accept cookies, Sullivan said, is one option, although it may result in some sites no longer working. Another possibility is to surf the internet using an anonymous IP address, which makes one’s movements difficult to track.
Sullivan also recommends logging off free e-mail accounts and other services that require registration when one is not actively using them.
Hoofnagle advises that Google users periodically delete the search engine’s tracking cookie. Or, they can set a rule in their cookie file not to permanently accept the Google cookie in the first place.
But Hoofnagle is most emphatic on one point: Stay away from Gmail. While 2 free GB of storage is a tempting offer, it’s not worth the trade-off of having e-mail monitored and scanned.
It’s advice Hoofnagle would rather give than take, however. In the 12 months since Google unveiled Gmail, Hoofnagle said he and nearly every other privacy advocate he knows has signed up for an account.
Of course, he said, they joined to monitor for invasive privacy practices, not for the 2 gigs of storage
