Microsoft-Yahoo: The Privacy Issue

The merged consumer databases of the prospective union should have Web surfers demanding what's being done with their personal information

As Yahoo! (YHOO) perseveres in resisting Microsoft's (MSFT) unwelcome takeover advances, the debate over whether, and by how much, the software giant will need to increase its $31-per-share bid is reaching fever pitch (, 4/8/08). But few Wall Street analysts doubt the software company will ultimately prevail.

Assuming those prognostications prove correct, the discussion will swiftly turn to what a blended Microsoft-Yahoo would look like, and what Microsoft will need to do to justify a likely $40 billion-plus sale price.

Post-Acquisition Musts

After some initial cost cutting, the enlarged company will presumably try to gussy up Microsoft's product offerings to flog to Yahoo's user base. This could be a problematic upsell, as the average Yahoo user is not used to paying for anything.

The real post-acquisition gain will hinge on how well the new company can forge relationships with customers, based on the information people share online and how they use the "Microhoo" lineup of products and services. This will require some new thinking from Microsoft, a company that makes most of its money from dealing with license holders—not consumers who use its products for free.

The company will have to continue managing personal software licensing but also establish longtime intimacy with customers. Combining the two strategies will require Microsoft to become what's known as an identity management company. These companies create, maintain, disseminate, and even dispose of our online personas. Think of them as the unseen, unappreciated, and often unpaid service staff of the digital world, responsible for authenticating digital credentials, managing the mail, maintaining the switchboard for VoIP (Voice-over-Internet Protocol) calls, and acting as the universal directory for online search.

Here's the rub: As the blended companies merge databases and assume this role, they will gain an unprecedented amount of insight into consumers' online behavior and buying habits. What we do will be correlated to what we buy. What we search will be tracked through to an ad, maybe all the way to a purchase.

Duopoly in ID Management?

That will cause discomfort. And Microsoft isn't the only company coming to terms with it. Once Google (GOOG) has completed its acquisition of DoubleClick, which handles ad placement across the Web, the new company would be both the preeminent search company and the leading digital marketing firm. "DoubleGoogle" will use what it knows about people's searches to better target ads for those users.

As both pairs of companies evolve to this next level of digital customer intimacy, the potential for privacy problems increases dramatically. Identity management companies should be held to a higher privacy standard than the one applied to software or search firms. With two large companies competing in this emerging space, there will not be room for many—or even any—more competitors. The consumer digital marketing space will be run for many years to come by a duopoly—a duopoly of identity management companies.

The biggest privacy question in both of these acquisitions is what will happen to the merged and growing databases of consumer information. Will all of this information—our personal data, our searches, e-mails, chat sessions, purchases from Yahoo sites, or results of a session on Microsoft's Xbox Live gaming service—be matched and cross-indexed for marketing purposes? How long will the information be retained? Yahoo keeps data for 13 months, Google for 18. Will the two megacompanies agree not to collude or share data in any way?

Privacy Policy

The last question is especially important because any policy shared by both companies, either formally or tacitly, becomes the status quo. Given the current legal privacy vacuum in the U.S., the duopoly would in effect be able to create privacy policy for much of the Internet.

Google CEO Eric Schmidt may have expressed this fear best when he said of the Microsoft/Yahoo acquisition: "We would hope that anything they did would be consistent with the openness of the Internet, but I doubt it would be." Of course, the same sentiment could be expressed about Google.

When these companies devote more of their technological resources to innovating data mining, they will know an uncomfortable amount of personal information about each of us. Add even more personal data derived analytically by techniques such as correlating IP addresses to postal address or equating credit-card or financial account information to browsing history, and they will know more about the routine habits of each Internet user than any other organization in the world, including the U.S. government.

An Ideal Contract

Consumers need a genuine and deep commitment by these two groups of companies to consumer privacy. It would be nice for both to adopt a pro-consumer position that was more generous than any legal system requires. They should state up front what they will and won't do with our precious consumer information.

How much information will they keep and for how long? What will they do with the information? How much mining will they do? What do consumers have to opt in for, and out from? Will they only use personal information for purposes consumers had previously agreed to? Would they show consumers, on request, what personal information they are storing, and maybe even delete that information if asked?

As a consumer, I'd be comfortable with a meaty commitment to privacy by both companies. If they give me that, they can buy General Motors (GM) for all I care.

Before it's here, it's on the Bloomberg Terminal.