Yahoo ranked third of the 12 internet and mobile companies evaluated, behind Google and Microsoft, and the third in the Index overall. A founding member of the Global Network Initiative (GNI), the company’s disclosures related to freedom of expression and privacy are overseen by the Yahoo Business and Human Rights Program, established in 2008 to help integrate human rights-related decision-making into the company’s business operations. However, recent revelations about large-scale data breaches at Yahoo highlight why the company’s lack of disclosure about its policies for informing affected parties about data breaches and steps taken to mitigate damage should be a concern for users and other stakeholders—though it should be noted that no internet or mobile company evaluated provided disclosures related to data breaches (P15). and mobile companies evaluated, behind Google and Microsoft, and the third in the Index overall. A founding member of the Global Network Initiative (GNI), the company’s disclosures related to freedom of expression and privacy are overseen by the Yahoo Business and Human Rights Program, established in 2008 to help integrate human rights-related decision-making into the company’s business operations. However, recent revelations about large-scale data breaches at Yahoo highlight why the company’s lack of disclosure about its policies for informing affected parties about data breaches and steps taken to mitigate damage should be a concern for users and other stakeholders—though it should be noted that no internet or mobile company evaluated provided disclosures related to data breaches (P15).
Yahoo! Inc. provides a broad range of communication, sharing, and information and content services. Its services include the search platform Yahoo Search, communication and collaboration tools including Yahoo Mail, Yahoo Messenger, and Yahoo Groups, digital content through Yahoo.com, Yahoo Sports, and Yahoo Finance, advertising services, and multiple other services and properties. The Yahoo services evaluated in the Index are all included in an acquisition deal with Verizon Communications, though the actual sale to Verizon has not yet been finalized.
Yahoo tied with Microsoft for the highest score of all 22 companies in the Governance category. The company disclosed a clear commitment to freedom of expression and privacy as human rights (G1), evidence of senior leadership oversight of human rights concerns (G2), and provides employee training and a whistleblower program addressing freedom of expression and privacy (G3). As a member of the GNI, Yahoo disclosed that it engages with stakeholders, including civil society, on freedom of expression and privacy issues (G5).
Yahoo was the only company to receive full credit for its disclosures about its human rights due diligence processes (G4). As with many companies evaluated in the Index, Yahoo did not disclose sufficient grievance and remedy mechanisms (G6). Its privacy policy indicated how users can contact them with complaints related to privacy concerns, but did not provide further information about its process for receiving and responding to these complaints.
Yahoo received the fifth-highest score of the 12 internet and mobile companies evaluated in the Freedom of Expression category, behind Google, Kakao, Microsoft, and Twitter.
Content and account restrictions: Yahoo’s disclosure of its process for enforcing its terms of service rules (F3) was roughly on par with that of Twitter, though less detailed than that of Google or Kakao. Similar to most (but not all) other companies, Yahoo did not disclose any data about the volume or nature of actions the company takes of its own accord to enforce its rules, such as removing content or restricting users’ accounts for violating its terms of service (F4). Given that companies like Microsoft and Twitter are starting to engage in this practice, Yahoo should endeavor to start disclosing this type of data in its next transparency report.
Content and account restriction requests: Yahoo was the second-highest scoring company, behind Google, for this set of indicators (F5-F7). The company received full credit for disclosures on its processes for responding to government requests for account or content restriction, but it provided less thorough disclosure on its processes for content or account restriction requests from private parties (F5).
Identity policy: To set up a Yahoo account (which can be used as a login for Yahoo Mail and Flickr), Yahoo disclosed that it requires that users provide a phone number, which in some jurisdictions can be used (e.g. by law enforcement or other government officials) to connect a user with their offline identity (F11).
Yahoo received the third-highest score of the 12 internet and mobile companies evaluated in the Privacy category, behind Google and Microsoft.
Handling of user information: Yahoo received the third-highest score of all companies evaluated in the Index for this set of indicators, behind Twitter and Google (P3-P9). Yahoo provided users with greater clarity about what user information it collects and shares (P3, P4) than it did about its reasons for doing so (P5). Yahoo tied with Microsoft for the third-highest score for its disclosures on its policies for retention of user information (P6). Yahoo offered more information than most internet and mobile companies about how users can access the information that the company holds about them (P8), with only Google receiving a higher score.
Requests for user information: Yahoo received the second-highest score on the indicator related to disclosure of its process for responding to government and other third-party requests for user information (P10), behind only Microsoft. However, it disclosed less than all other U.S. internet and mobile companies about its compliance with government and private requests for user data (P11).
Security: Yahoo disclosed less about its security policies than Google, Yandex, Microsoft, and Apple (P13-P18). Its disclosure of its internal oversight mechanisms to ensure the security of its products was inconsistent across the three Yahoo services evaluated (P13). As noted, Yahoo offered no disclosure of its processes for communicating about data breaches (P15) although this was true of all internet and mobile companies in this Index.
