Yahoo, Inc.
Headquartered in the United States, Yahoo provides email, news, and search platforms. It draws its revenue primarily from advertising as well as from its subscription-based financial information service.
In 2021, Yahoo, formerly owned by Verizon Media, became a subsidiary of the private equity firm Apollo Global Management. The change has left the future of human rights oversight at the company unclear to the public. Yahoo was the first U.S.-based tech giant to build a team that worked to integrate human rights due diligence across its products and services. The team emerged after the company was taken to court and brought before the U.S. Congress over its decision to give Chinese officials access to sensitive data associated with the email account of Chinese journalist Shi Tao, who was arrested and jailed for eight years as a result.
In our first evaluation of Yahoo, published in 2015, it disclosed more comprehensive information about its human rights impact assessments than any other ranked company. But Yahoo’s acquisition by Apollo seems to have brought about a turn in this trajectory. Following the sale, Yahoo stopped committing to conduct in-depth secondary evaluations on the human rights impacts of laws, regulations, and its own policy enforcement when risks are detected. Although Apollo is publicly traded and has a board of directors, Yahoo is not represented on its board, and that governing body has yet to publicly acknowledge or address the unique human rights challenges that Yahoo faces.
Nevertheless, in our evaluation for 2022, the platform earned the top score for privacy, owing to improved security and data breach policies. These improvements may have been triggered by a class action lawsuit concerning data breaches that implicated billions of Yahoo accounts. The court found that the platform had failed to promptly disclose these breaches and ordered the company to beef up its data protection systems and mechanisms for addressing security vulnerabilities. Yahoo settled the suit in July 2020.
The platform also has continued to make headlines concerning its use of people’s data in the ad-tech market and its activities in foreign jurisdictions. It came under fire from civil society for deploying user data to target ads through online exchanges that facilitate the sale of ad space to sites known for spreading disinformation, such as Breitbart News and Steve Bannon’s War Room. Yahoo also made headlines when it officially withdrew from China, citing a challenging regulatory environment. This move was largely symbolic, however, given that most of its services were already blocked in the country.
The 2022 Big Tech Scorecard covers policies that were active on November 1, 2021. Policies that came into effect after November 1, 2021, were not evaluated for this ranking.
Scores reflect the average score across the services we evaluated, with each service weighted equally.
We rank companies on their governance, and on their policies and practices affecting freedom of expression and privacy.
Yahoo failed to maintain its documentation about its human rights impact assessments when it changed ownership (G4), contributing to an overall decline in this category. The board of Apollo, Yahoo’s new owner, did not commit to oversee freedom of expression and privacy issues on the platform (G2). Access to remedy remained a weak point in Yahoo’s governance performance. The platform provided some information on grievance mechanisms, but it did not include a time frame for its responses or any data about the functioning of the mechanism (G6a).
Yahoo’s policies regarding freedom of expression also became less clear. The company stopped committing to notify users when it restricts their content (F8), and removed its explanation of a proactive system for detecting CSAM (F3). It disclosed nothing about the nature and volume of user-generated content it removed on the basis of rule violations, but did publish some general data about how it enforces its advertising policies (F4c). Yahoo was the only platform we evaluated to state that human reviewers examined at least some of its algorithmically generated advertising audience lists (F3c).
For the first time, Yahoo disclosed that it commissioned third-party security audits (P13). It also published a policy on how it addresses data breaches (P15). Though the platform led our ranking in the privacy category, it did not give its users sufficient control over the collection and use of their data. It was not clear that users could delete all of their personal information or halt its collection (P6, P7).