http://arstechnica.com/news.ars/post/20081217-yahoo-outdoes-google-will-scrub-search-logs-after-90-days.html

It's a race to the bottom, but in a good way. Yahoo today announced an "industry-leading approach" to online privacy under which it will anonymize its log data after 90 days. The move comes only months after Google cut its own retention period for personal data by 50 percent, and it gives Yahoo by far the strongest anonymization policy of the big three search engines.

The announcement also scored points with Congress. Rep. Ed Markey (D-MA), a powerful voice on tech issues, this morning applauded the company, essentially placing the privacy crown atop its corporate head. "Today, Yahoo voluntarily sets a new standard for such privacy protection, a standard against which Microsoft, Google, and others will now be compared," he said. "I urge other leading online companies to match or beat the commitments announced by Yahoo."

That's exactly the message Yahoo wants to convey. In its announcement, the company stressed that it had just made the TRUSTe/Ponemon Institute Top 20 list of "Most Trusted Companies for Privacy." Yahoo came in 14th after previously being off the list; Google and Microsoft did not make it.

Under the new policy, log data can be retained, but IP addresses will be anonymized after 90 days. The data affected isn't just search logs, either, but "page views, page clicks, ad views, and ad clicks." Yahoo makes exceptions to the policy for "fraud, security, and legal obligations," so if any jurisdiction in which it operates passes mandatory data retention laws, the 90-day guarantee is overridden there.

Google has been cutting its own retention period for personal information, though not quite so dramatically. Google at first agreed to anonymize its server logs after 18-24 months; after pressure from the European Union, Google agreed to anonymize its logs after 18 months. In September, it cut that to nine months.

Microsoft keeps the identifying information in its logs longest of all, at 18 months. Some smaller search engines, like Ask.com, offer even more control over information collection.

Anonymizing logs isn't the Holy Grail of the privacy quest, but it is a good start. As the AOL "anonymized" data release showed us, though, doing anonymization badly can still make it possible to identify individuals. (It can also lead to new works of art.)