Microsoft Responds To Bing Privacy Concerns

Microsoft has said it will delete the stored IP addresses of Bing users after six months, as Redmond responds to privacy concerns from advocates and regulators.

“We will delete the entire Internet Protocol address associated with search queries at six months rather than 18 months,” Peter Cullen, Microsoft’s chief privacy strategist, wrote in a 18 January posting on the Microsoft On The Issues blog. “This change is the result of a number of factors including a continuing evaluation of our business needs, the current competitive landscape and our ongoing dialogue with privacy advocates, consumer groups, and regulators.”

Some of those regulators and privacy advocates cited by Cullen include the Article 29 Working Party, “the group of 27 European national data protection regulators charged with providing advice to the European Commission and other EU institutions on data protection.”

The Article 29 Working Party has issued guidelines in the past for protecting users’ personal data online. Specifically, the group has asked search engine providers to limit the amount of time that they retain IP addresses and other search data.

“Search engines fall under the EU Data Protection Directive 95/46/EC if there are controllers collecting users’ IP addresses or search history information, and therefore have to comply with relevant provisions,” the group wrote in a statement released in February 2008.

Cullen also claimed in the posting that, under current Microsoft policy, the company separates search-query data from the account information “that could identify the person who performed the search.” After the 18-month mark, Microsoft also apparently deletes the IP address, the “de-identified” cookie ID and any cross-section IDs associated with the query. Within the next 12 to 18 months, though, that IP-deleting mark will be lowered to six months.

“There are many good reasons to retain and review search data,” Cullen wrote. “Studying trends in search queries enables us to improve the quality of our results, protect against fraud and maintain a secure and viable business.”

As search engines have become more adept at data-mining users’ information – ostensibly for improving search results and providing more useful applications – inevitable privacy concerns have arisen from a number of quarters. Google has taken several steps recently to assuage privacy critics, such as providing a summary of application data associated with user accounts.

But Cullen’s mention of the Article 29 Working Party indicates that Bing’s latest privacy move is more than Microsoft ceding to generalised privacy concerns; indeed, this adjustment to the user-data deletion date may also be the company attempting to head off a possible complaint from the European Commission.