MB Civic

When people search the Internet in their homes, it feels like a private activity. But as AOL reminded the world this month, when it made public 19 million search queries by customers, companies often store searches in ways that allow them to be traced back to specific users. The storing and sharing of data of this kind is a violation of users’ privacy rights. Congress, the Federal Trade Commission and the companies should do more to protect these rights.

When people talk on the phone, they assume that the words they utter will disappear when the call is over. They certainly do not expect that their phone company is recording and storing the words, to mine for commercial purposes or to sell to other companies. People have the same expectation about the Internet searches they do: when the search is over, the words they used will disappear.

But that is not how search engine companies are treating the data. Google and other companies store search information indefinitely, and once the data is stored it can easily get out. The companies may sell it to third parties. They may be forced to hand it over in response to a subpoena. Or employees at the companies can leak the information.

People often include information in their Internet searches that they do not want to share with the world. They may be searching for information about topics like cancer or spousal abuse, or looking for sex or gambling Web sites. They may be looking for organizations that are critical of the government.

There should be strong safeguards in place to prevent search engine companies from storing and using this data. The Bush administration, however, has been pushing in the opposite direction. Earlier this year, Attorney General Alberto Gonzales urged Internet companies to keep user data for long periods to help law enforcement.

Congress should step in. Search data is arguably protected by existing privacy laws, but Congress should pass new legislation that removes any doubt. Representative Edward Markey, Democrat of Massachusetts, has introduced a bill to prohibit Internet companies from warehousing personal data, including search queries. It is a good start, but it still gives companies too much leeway to keep data. The bill should be strengthened and passed.

The F.T.C. should also do more. The Electronic Frontier Foundation has filed a complaint against AOL, arguing that the recent well-publicized release of search data from 600,000 AOL customers was a deceptive trade practice. The F.T.C. should uphold the complaint, and send a clear message that invasions of privacy of this sort will be punished.

Whatever the government does, the companies themselves should be acting more responsibly. People who use the Internet have a right to expect privacy. If companies do not have their users’ affirmative consent to keep data, they should delete it, and make money from the many other, very profitable parts of the search engine business.