OneSearch U.S. Privacy Notice

1. Overview

About this Privacy Notice

This Privacy Notice describes Yahoo's data processing practices regarding the collection and use of your Personal Data when using our OneSearch Service. The notice also sets out your privacy rights and how to exercise those rights. It applies to our consumer customers that use OneSearch, but doesn’t apply to the information we hold about companies or organizations. This Privacy Notice applies to individuals using the OneSearch Service who are located in the United States.

Please read this Privacy Notice carefully as it applies to the OneSearch Service we provide to you from the United States.

User technical support is provided by Yahoo and any data provided for customer support is governed by the different policy presented to the user during the support request process.

Date of last update

This Privacy Notice was last updated on September 1,  2021.

Changes since the last version

Since the last version, the fraud detection process has been updated, and this notice has been updated to reflect this update. Product functionality added since the launch has not changed our privacy practices.

We may amend this Privacy Notice from time to time (see Section 10) and where these changes are material we will endeavor to give you reasonable notice of these changes through the OneSearch website, app or browser extension. 

How to read this Privacy Notice

Technology is a fast changing area and can be complicated. To help you understand our policy, we have included a glossary which explains the meaning of any technical terms we use. Throughout this policy we have highlighted in bold font key technical terms which we have included a definition for in the glossary.

Previous version of this privacy notice

• January 2020 version 1.0 - original version (US, EMEA, Canada)
• October 2020 version 1.1 - minor textual updates and clarifications (US, EMEA, Canada)
• February, 2021 version 1.2 - separation of US, EMEA, and International privacy policies. You are reading the International version of this policy, that covers our OneSearch Service in Canada, Australia, Brazil, Hong Kong, Indonesia, India, Singapore, the Philippines, Taiwan, Argentina, Chile, Columbia, Mexico, Peru and Venezuela
• September 2021 - brand update from Verizon Media to Yahoo

Who we are

The OneSearch Service in the United States of America is operated by Oath Inc., d/b/a Yahoo (“Yahoo”, “we”, “our”, or “us”), a company with headquarters at 701 First Ave. Sunnyvale, CA 94089, USA. Oath Inc. provides the OneSearch Service to you and is the Controller of the Personal Data processed when you use the OneSearch Service.

Which services are covered?

This Privacy Notice applies only to the following services provided by the OneSearch Service:

• OneSearch search engine;
• OneSearch’s website;
• OneSearch iOS and Android mobile applications ("OneSearch Apps"); and
• OneSearch browser extension.

This Privacy Notice describes to you, the user, our data processing practices for this Service (also referred to as the “OneSearch Service”). It informs you about the limited collection, transfer, Encryption, storage, and disclosure of your information for the purposes of providing this Service.

Legal Jurisdiction

Yahoo is headquartered in the United States and as such, the processing will be subject to United States laws.

What is not covered/under our control

This Privacy Notice only covers the services provided by the OneSearch Service that we control. This Privacy Notice does not cover any collection and further processing of Personal Data by:

• Any party (including Yahoo) when you click on any link provided as a result of a search made with the OneSearch Service (e.g., when you access a URL provided in the search results, Cookies may be dropped).
• Any third party who may access Personal Data that you make available when using the OneSearch Service (e.g., your internet service provider, the provider of your web browser or the provider of any browser extension you may be using to access the Service).

Specific points related to OneSearch Apps

Please note that the OneSearch Apps provide web browser services along with their search engine services. They can also be used as your default web browser for your mobile device. In relation to these functions it is important for you to realize that:

• The address bar at the top of the display within the OneSearch Apps operates as both a search field and as a field for inserting website addresses, depending on what you enter within it.
• Any term you enter into the address bar on the OneSearch Apps which does not qualify as a full website address (e.g., a phrase that does not end in ".com" or ".org") will be treated as a OneSearch Search Query and will be subject to this Privacy Notice.
• If you enter and confirm a full website address (e.g., a phrase ending in ".com" or ".org") within the address bar on the OneSearch Apps then you will be taken to that website and not to a OneSearch search results page. The Controller of the website that you are taken to may collect and process personal data about you (e.g., through Cookies).
• If you have the OneSearch Apps set as your default web browser then any link to a website that you click on from OneSearch Apps  or another application (e.g., from your email application, or by clicking on a Bookmark) will take you to that website on the OneSearch Apps. The Controller of the website that you are taken to may collect and process personal data about you (e.g., through Cookies).
• All characters that you type into the address bar on the OneSearch Apps will be provided to Yahoo for Search Assist. The collection and further processing of this data is subject to this Privacy Notice.

2. Glossary

This section explains the terms used within this Privacy Notice whose meaning may not be immediately obvious. Wherever we have used these terms in the Privacy Notice we have Bolded and Capitalized them to indicate that a definition for them is provided in this section.

• Our Affiliates include the corporate affiliates of Yahoo. They provide infrastructural, security and technical support to enable us to provide the OneSearch Service.
• A Bookmark is a functionality provided by the Service whereby you can save a shortcut to your favorite search result page(s). This feature is not available when OneSearch’s Advanced Privacy Mode is enabled.
• A Cookie is a packet of information sent by a server to a Web browser and then sent back by the browser each time it accesses that server. For example, they can be used to identify users and cache user preferences (such as but not limited to user selected graphics).
• The Controller is the entity who determines the purposes for which and the manner in which any Personal Data is to be collected and processed. For the OneSearch Service, Yahoo is the Controller.
• Encryption is the process of changing electronic information or signals into a secret code (known as a cipher) so that it cannot be read or deciphered by anyone who does not have the key used to create the cipher. The method(s) of Encryption that the OneSearch Service uses are described through this link.
• A Fraud Score is a score that is correlated to the chance that a specific Search Query is being made for fraudulent purposes. This score is produced through the Network Traffic Protection function of the Services.
• IP Address is a unique electronic address made up of a series of numbers which identifies the device or internet access point that you are using. It is necessary in order to identify where information should be sent when a request over the Internet is made.
• Location Data is information derived from your IP Address to determine your general location. We only use Location Data to provide you with useful location specific search results. Although different levels of specificity of location can sometimes be inferred from IP Addresses (e.g., country, state, city, zip code, house/office), we only infer Location Data at the city level of specificity unless you have specifically selected that we provide you with results to a zip code or similar, but still imprecise, level of specificity through the Set Location Functionality. We do not collect or infer Location Data that is more specific than within a 500 meter radius. It is also worth noting that your search results may also be tailored towards a specific location if you have submitted a Search Query which indicates a location within it (e.g., if you search "Pizza Restaurants Los Angeles").
• Network Traffic Protection is a general term to describe actions that we take in order to protect users, our systems and the Search Provider's systems from harm and/or misuse. Examples of the types of harm and misuse that we are looking to protect against are hacking attacks and fraudulent clicks. A user's IP Address, and possibly their User Agent, are used to complete this purpose.
• Obfuscation, in relation to this Service, is a process of rendering an IP Address as no longer specific to a single device. For example, if your IPv4 IP Address was 102.3.3.201, this could be obfuscated by dropping the last octet or byte of the address, making the IP Address 102.3.3.### (for example, 102.3.3.000). After Obfuscation, your Search Query is no longer connected to you through your IP Address.
• Personal Data means any information relating to an identified or identifiable natural person (“user” or “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Search Assist is a functionality whereby we provide you with suggested terms for your Search Query based on the characters you enter in a OneSearch search field (e.g. if you type in the characters "flowe" then a search for "flowers" may be suggested). No Personal Data about you is stored more than momentarily through the Search Assist functionality as there is no storage of your IP Address after the Search Assist results have been provided to you.
• Search Optimization is a process whereby we work with our Search Partners to provide you with contextual advertisements and/or search results. As part of the process of selecting what advertising to provide you, we do not consider any of your previous search history or any other Personal Data that identifies you. Rather, we only provide these contextual advertisements and/or search results based on each individual search that you perform. For example, if you search for “flower shops” we may display an advertisement/search result for one or more flower shops. We will sometimes provide your Search Query and/or your general location to certain Search Partners in order to provide you with advertisements/search results but the information they receive is never identifiable to you (unless you identify yourself in the Search Query or through the Set Location Functionality, for example by inputting your name or entering your home address) as we do not provide your IP Address to any Search Partners.
• Search Provider is our third-party provider that delivers search results in response to your Search Query.
• Search Partners are third parties that provide advertising, content, and additional search results as part of the Service. They are not provided with your Personal Data unless you or someone else identifies you in a Search Query or through the Set Location Functionality (e.g., by inputting your name or entering your home address) or if you click on a sponsored search result.
• Search Query is the characters that you input within a OneSearch search field and confirm (e.g., by pressing the "Enter" button on a keyboard or clicking the "search" icon) or the term(s) that you select from Search Assist or a suggestion module in OneSearch such as those under the heading “Related Searches.”).
• Search Stack is a general term we use to describe the internal systems used to provide the OneSearch Service.
• Set Location Functionality is the optional ability you have to select a more specific or different location for which you would like your search results to automatically be tailored. You may choose a city location or you may choose a zip code or similar, but still imprecise, level of specificity. We do not collect or iner Location Data that is more specific than within a 500 meter radius. The location you selected does not have to relate to your actual location (e.g., you may wish to search for restaurants in an area you will be travelling to soon). When using our website and when using our browser extension the Set Location Functionality resets each time you close a OneSearch browser session (i.e., your location selection will not be remembered the next time you use the OneSearch website or browser extension). When using the OneSearch App this functionality resets each time you shut down the App (i.e., your location selection will not be remembered the next time you open the OneSearch App).
• A Token is simply a form of identifier (i.e. a string of characters used associated with other data points). We use a Token in place of your IP Address when requesting search results and contextual advertising from our Search Provider in order to make your search experience as private as possible. It is important to recognise that these are one-time tokens, which means that they are only able to identify data associated with a single search.
• User Agent is the term we use for data about the software and hardware that is being used when a user makes a search. For example, this can include data about the browser, operating system, type of computer and/or app that is being used to make a search. The collection of this data is necessary to properly provide the service to different types of software and hardware being used (e.g., so that search results are provided on a mobile phone friendly interface when a search comes from a mobile phone) and for Network Traffic Protection purposes.

3. What Data Do We Collect, How We Use It and Why We Do This

In this section we describe what Personal Data we collect, why we collect it and how we process it.

In order to test the processes that we use, your search may be completed through one of two different systems (what is sometimes known as "A/B" or "bucket" testing). The systems are similar in many ways but not the same. The decision about which system your search is processed through is random and cannot be manually decided by you.

The data processing that takes place through the first system (“System A”) is explained below in section 3(a) and the data processing that takes place through the second system (“System B”) is explained below in section 3(b).

3(a) Data processing through System A

When you make a search no Personal Data will be transferred to any Search Partner unless you identify yourself or anyone else in the Search Query.

When you input characters into the OneSearch search field, the characters you input will be used for the Search Assist functionality. When you confirm a Search Query, your IP Address, the Search Query and User Agent will be securely transferred from your browser to our Search Stack.

We need to process your IP Address, User Agent and Search Query together to fulfill your search. We derive your imprecise Location Data from your IP Address so that we can tailor the search results to you and your location. The provision of this limited data is necessary to provide the OneSearch Service to you, and if it is not provided, we will not be able to perform the OneSearch Service.

We will also process your more specific or different location when you choose to give it to us using the Set Location Functionality. We do this so that we can provide location-specific search results (e.g., if you search "flower shops" then flower shops in the city or area that you select may be provided in the results).

We provide your IP Address and User Agent to our Search Provider so that they can undertake Network Traffic Protection processing with this data for 90 days. This includes producing a Fraud Score.

To fulfil your search, we provide a Token, your Search Query, Location Data, User Agent and Fraud Score to our Search Provider. This means that it should not be possible for the Search Provider to connect your Search Query with your IP Address because the one-time Token is used in place of your IP Address.

After a Search Query has been completed, Yahoo will store your IP Address and User Agent in different servers in such a way that they should not be capable of being connected. From that point, we are not able to tell which IP Address any Search Query has come from.  

If you click on a sponsored search result (identified as an ad), the Search Provider will collect your IP Address. Similarly, if you click on sponsored content from a Search Partner, the Search Partner may collect your IP Address.

3(b) Data processing through System B

When you make a search no Personal Data will be transferred to our Search Provider or any Search Partner unless you identify yourself or anyone else in the Search Query.

When you input characters into the OneSearch search field, the characters you input will be used for the Search Assist functionality. When you confirm a Search Query, your IP Address, the Search Query and User Agent will be securely transferred from your browser to our Search Stack.

We need to process your IP Address, User Agent and Search Query together to fulfill your search. We derive your imprecise Location Data from your IP Address so that we can tailor the search results to you and your location. The provision of this limited data is necessary to provide the OneSearch Service to you, and if it is not provided, we will not be able to perform the OneSearch Service.

We will also process your more specific or different location when you choose to give it to us using the Set Location Functionality. We do this so that we can provide location-specific search results (e.g., if you search "flower shops" then flower shops in the city or area that you select may be provided in the results).

When we fulfill a search request we will transfer your Obfuscated IP Address, Search Query, Location Data and User Agent to our Search Provider to process. Our Search Provider is not able to link a Search Query back to you, as your IP Address is Obfuscated before we send it to them.

3(c) Data processing common to both System A and System B

We may also carry out Search Optimization by including information from Search Partners who, in some cases, receive your Search Query and Location Data. We then provide search results to your browser so that you can see them.

Very shortly (i.e., within seconds) after a Search Query has been completed, we will store your IP Address, Search Query and User Agent in different servers in such a way that they should not be capable of being connected. From that point, we are not able to tell which IP Address any Search Query has come from. The only Personal Data which we then hold about you is your IP Address, unless you have identified yourself in the Search Query or through the Set Location Functionality (e.g., by inputting your name or home address).

When you make a search, we also process your IP Address for the purpose of Network Traffic Protection.

If you click on a sponsored search result (identified as an ad), the Search Provider will collect your IP Address. Similarly, if you click on sponsored content from a Search Partner, the Search Partner may collect your IP Address.

We also may access, preserve, and share any category of data described in this Privacy Notice with government agencies and third parties to protect you and the general public, prevent infringement of our Terms or violations of third parties’ rights and to assist in the prevention, investigation, detection or prosecution of criminal offences or other unlawful activity. Please see section 5 for further information on this topic.

4. Encryption and short term storage of browser history

When you click the search button, the URL of the search results page that comes up on your browser, on our browser extension or on the OneSearch Apps will be encrypted so the Search Query will not be found in, or identifiable from, the URL. Certain of the information contained in the URL relates to a Where on Earth ID, which is a numerical value that can be associated with a generalized geolocation relating to the target location of your search. This URL expires after an hour if OneSearch Advanced Privacy Mode was enabled when the Search Query was submitted. Further information about this part of the Service, and the Encryption used, can be found here.

5. Retention

Yahoo and its Search Provider retain the limited types of data, which we collect stemming from your use of the OneSearch Service, for the periods set out below, except where it is retained in exceptional circumstances to comply with a legal obligation or address a security, fraud, or legal incident (please see section 6 for more information on this topic).

Type of Data	Yahoo Retention Period	Search Provider
IP Address	4 days	90 days
Obfuscated IP Address	N/A	180 days
Search Query	180 days	180 days
User Agent	180 days	90 days
Location Data	180 days	18 months

6. With whom we share your Personal Data

Except as necessary to provide the Service, we never share Personal Data we receive from you unless: (a) we have your separate and explicit permission to share that information; or (b) we have given you prior notice that the information will be shared, and with whom (such as in this Privacy Notice).

We share data with our service providers (sometimes referred to as “processors”) that work on our behalf and process your data solely at our direction. The following service providers help us provide the OneSearch Service:

• Our Affiliates;
• Our Search Provider, Microsoft, who provides relevant search results, advertising, and content in response to a user’s Search Query, which is required to operate the OneSearch Service; and
• Our Search Partners who provide Search Optimization services which provide you with contextual advertisements and/or search results.

If you or anyone else enters Personal Data or location information like your or someone else's address in the Search Query or Set Location Functionality, it will be shared with these service providers.

7.  Legal Obligations and Terms of Service Enforcement

We reserve the right to access, preserve and disclose any Personal Data to investigate, prevent, or take action in connection with legal process and legal requests, and for enforcement of the Terms of Service.

8. How do we protect your data?

We have implemented the appropriate technical and organizational measures to ensure a level of security in relation to your Personal Data that is appropriate to any risk associated with it.

Your Personal Data is processed and stored in servers that are located in the USA.

9. Details for California Residents

California residents have certain privacy rights under the California Consumer Privacy Act of 2018, also known as the CCPA.  This section of the Privacy Notice provides OneSearch-related CCPA information only.  For other CCPA details relating to other Yahoo services, please visit this page.

The CCPA defines certain terms in a particular manner that may differ from how those terms are used in everyday language. When these terms are used in this California section of the Privacy Notice, they are used based on the definitions set forth in the CCPA.  These terms are: “personal information”, “consumer”, “business purpose”, “commercial purpose”, “financial incentive”, “service provider”, “third party”, and “sale” or “sell”. Other capitalized terms have the definitions set forth in section 2 of this Privacy Notice.

CCPA Summary of Data Processing

For extended details about Yahoo’s collection, use and disclosure of personal information in the context of OneSearch, please review sections 2–6 of this Privacy Notice.

We collect the following personal information:  IP Addresses (which the CCPA labels “identifiers” or “internet or electronic network activity information”) and the following information associated (temporarily) with IP Addresses: User Agent (which the CCPA labels “internet or electronic network activity information”); geolocation information; and Search Queries (which the CCPA labels “commercial information”); as well as inferences based on the other information we collect.  For clarity, these items are all only personal information when still connected to a full IP Address that itself is personal information.

We use this information to provide the OneSearch Service; for security purposes, including to detect and defend against fraudulent, abusive or unlawful activity; to protect you and the general public; to prevent infringement of our Terms or violations of others’ rights; and to assist in the prevention, investigation, detection or prosecution of criminal offences or other unlawful activity.

In the 12 months preceding the date this Privacy Notice was last updated, we disclosed information for business purposes as follows:

Category of information	Categories of recipients
Search Query, and Location Data	Search Partners and our Search Provider (note that if you click on a sponsored search result (identified as an ad), the Search Provider will also collect your IP Address. Similarly, if you click on sponsored content from a Search Partner, the Search Partner may also collect your IP Address. Any personal information entered as a Search Query or in the Set Location Functionality will also be shared with our Search Provider and possibly some of our Search Partners). Affiliates
Obfuscated IP Address and User Agent	Search Provider (note that if you click on a sponsored search result (identified as an ad), the Search Provider will also collect your IP Address.  Any personal information entered as a Search Query or in the Set Location Functionality will also be shared with our Search Provider). Affiliates
IP Address	Affiliates Search Provider Government entities upon legal request (note these IP Addresses may be linked to other information like Search Queries).

Yahoo has not sold and does not sell personal information it collects through the OneSearch Service. 

Yahoo collects personal information from the following categories of sources:  the OneSearch Service.

Summary of CCPA Privacy Rights 

The CCPA provides California consumers with the following five privacy rights. These rights are explained in further detail in the subsections below. 

• The right to know and the right to access the following for the preceding 12 month period: categories of personal information we collected, the categories of sources from which we collected personal information, the business or commercial purposes for which we collected personal information, and the categories of third parties with whom we share personal information, and the pieces of personal information we have collected about you. 
• The right to delete personal information that is not needed for specified purposes. 
• The right to not be discriminated against for exercising any of your CCPA rights.
• The right to opt out of sale of your personal information.

Right to Know

Under the CCPA, California consumers have the right to know following information for the preceding 12 month period: 

• the categories of personal information collected or used, disclosed for a business purpose, or otherwise shared; 
• the business purposes for collecting or sharing personal information;
• the commercial purposes for collecting or sharing personal information;
• the categories of sources of personal information;
• the categories of service providers to which personal information is disclosed for a business purpose;
• the categories of third parties to which personal information is shared; and
• the specific pieces of personal information collected or used.

You may make this request by contacting us via email at california_privacy@yahooinc.com.  However, given how OneSearch stores and retains data, and because Yahoo does not normally keep any personal information (i.e., IP Addresses) for longer than four days, it is unlikely that we will be able to verify your identity as somebody who has used our Service.  Moreover, the information that we could provide you is highly likely to be addressed already in this Privacy Notice.

Right to Access

The CCPA also gives Californians a right to request that a business provide them with a copy of their personal information.  You can make such a request via the email address listed above or by sending a request to the postal address listed in section 9 below.  However, because of how we store and retain information, it is unlikely that we would be able to locate your personal information.  Moreover, because it would be impossible for us to verify that the person making a request for a copy of the information is the same person who submitted the personal information to us in the first place (i.e., the same person who submitted the Search Query), and because we consider Search Query history to be sensitive, we expect to deny all such requests for access to personal information, consistent with the CCPA. 

Right to Delete

The CCPA gives Californians a right to request deletion of their personal information.  You can make such a request by emailing us at the address listed above or by sending a request to the postal address listed in section 9 below.   However, it is not necessary to make such requests because all personal information is automatically de-identified (and thus considered deleted for CCPA purposes) within four days, except where it is retained in exceptional circumstances to comply with a legal obligation or address a security, fraud, or legal incident (please see section 5 for more information on this topic).

Right to Not Be Discriminated Against 

Yahoo does not and will not discriminate against you because you exercise any of the CCPA rights described here.  You have the right to receive information about the financial incentives that we offer to you (if any).

Right to Opt Out of Sale

The CCPA allows Californians to opt out of the “sale” of their personal information.  However, personal information we collect through OneSearch is not sold.

10. Changes to this Privacy Notice

We may amend this Privacy Notice from time to time, using the process for modifications set forth in our Terms of Service. Use of any information we collect is subject to the Privacy Notice in effect at the time such information is collected.

11. Contact Us

If you would like to contact us for any reason then please use our contact form which can be found here (note that Cookies may be used if you click on this link) or at this address:

Yahoo
Attention: Member Services
701 First Ave.
Sunnyvale
CA 94089
USA

For a faster response we recommend using our online contact form.

If your query relates to the processing of your Personal Data or you wish to exercise your rights, you can contact our Data Protection Officer by email at dpo-contact@Yahoo.com or by post at:

Yahoo
Attention: Data Protection Officer
701 First Ave.
Sunnyvale
CA 94089
USA

For a faster response we recommend using email.

12. Change in ownership

If the ownership or control of all or part of Yahoo or the OneSearch Service is proposed to change as a result of a merger, acquisition or sale of assets, we most likely would not transfer Personal Data, as described in sections 2 and 3 above, to the new (or prospective) owner as part of the transfer of OneSearch. We will notify you of any such changes in advance.

13. Impact if you choose not to provide personal data

You may choose to provide or not to provide the relevant personal data required for the OneSearch Service to operate. In the case that you refuse to provide the relevant personal data, Yahoo and other entities entrusted by Yahoo may not be able to provide the Service.