Post-PRISM, Google Confirms Quietly Moving To Make All Searches Secure, Except For Ad Clicks

Not ProvidedIn the past month, Google quietly made a change aimed at encrypting all search activity — except for clicks on ads. Google says this has been done to provide “extra protection” for searchers, and the company may be aiming to block NSA spying activity. Possibly, it’s a move to increase ad sales. Or both. Welcome to the confusing world of Google secure search.

Two Years Ago: Secure Searching For Logged-In Users

In October 2011, Google began encrypting searches for anyone who was logged into Google. The reason given was privacy. Google said it wanted to block anyone who might potentially be eavesdropping on a string of searches made by an individual and also prevent the actual search terms themselves from being seen by publishers, as some of them might be too “private” to reveal.

This Month: Secure Searching Being Made Default For Everyone

Now, Google has flipped on encryption for people who aren’t even signed-in. When asked about this last week, Google confirmed the shift, saying:

We added SSL encryption for our signed-in search users in 2011, as well as searches from the Chrome omnibox earlier this year. We’re now working to bring this extra protection to more users who are not signed in.

I sent a series of follow-up questions to Google after getting that statement and am still waiting for a response to them, so I’ll update as I hear more. Is this worldwide? How soon until it happens for everyone?

A Sudden Change

One key question is “Why so suddenly?,” what prompted Google to make such a change out of the blue. And it was sudden.

When searches are encrypted, search terms that are normally passed along to publishers after someone clicks on their links at Google get withheld. In Google Analytics, the actual term is replaced with a “Not Provided” notation.

Over the past two years, the percentage of search terms as “not provided” has increased as Mozilla’s Firefox in July 2012Apple’s Safari browser in iOS 6 in September 2012 and Google’s own Chrome browser in January 2013 have used encrypted search, even when people aren’t signed in at Google.

That’s lead to a steady increase but not giant leap in “not provided” activity. But in the past month, the increased encryption on Google’s side has produced a dramatic spike:

Not Provided Count - Charting the rise of (not provided) in Google Analytics-1

The chart above is from a site called Not Provided Count, and it tracks the percentage of terms being withheld across 60 different web sites. You can see the spike that began around the week of September 4 and which currently shows almost 75% of terms being withheld.

It was after viewing this chart on Friday that I asked Google if there had been some type of change, because the percentage of not provided terms can also vary from site to site — or even for “basket” of sites for different reasons. As noted, the change is real, and confirmed by Google.

There are two main reasons why Google may have made such a quick switch, and perhaps both are even factors.

Done To Block The NSA?

The first is the whole US National Security Agency spying thing. In June, Google was accused of cooperating to give the NSA instant and direct access to its search data through the PRISM spying program, something the company has strongly denied. That hasn’t saved it from criticism.

Since then, Google’s waged a campaign to allow it to be more transparent about the number of spying requests it says it does receive — on a limited basis and not involving direct access — but which it’s forbidden by US law from disclosing. It also began increasing encryption between its own data centers.

I suspect the increased encryption is related to Google’s NSA-pushback. It may also help ease pressure Google’s feeling from tiny players like Duck Duck Go making a “secure search” growth pitch to the media. Duck Duck Go and have seen large gains in traffic, though relatively speaking, what’s large is nothing for Google. The PR loss is far, far greater than the user loss, if any. But Google doesn’t like PR losses of any type.

Done To Boost Ad Sales?

The other reason is that Google recently made a change so that one of the easiest ways for publishers to see the actual terms that have been withheld over time is through the Google AdWords system.

See, apparently search terms aren’t so private that Google withholds them entirely. Rather, it withholds them from being transmitted in the clear across the internet. Publishers can still see these terms by going into the Google Webmaster Tools area, though they only see the top 2,000 per day and only going back for 90 days (something Google said earlier this month will increase to one year, in the future).

If publishers don’t somehow constantly archive these terms, they’re lost. But a change to Google AdWords in August allows publishers to store the terms as long as they like, for easy and instant access — as long as they use Google’s ad system.

It’s an odd situation that Google won’t archive search term data within the toolset it expressly built for non-advertisers — Google Webmaster Tools — but does allow this through its ad system. It suggests that terms have been withheld all along in part to create new Google advertisers.

Privacy Loophole Remains For Advertisers

That’s especially so given that ad search traffic has never been made secure. No encryption stops people from eavesdropping on the terms used when someone searches at Google and clicks on an ad. Google’s also never prevented this information from flowing directly to advertisers, in the way it has for non-advertisers.

More Background

So. Increased privacy to thwart the NSA? Or a handy excuse to do that and increase potential ad sales? If I learn more, I’ll update. Meanwhile, for more background, see the key article from earlier this month, below:

Postscript (5:05pm ET):

Google’s sent this update:

We want to provide SSL protection to as many users as we can, in as many regions as we can — we added non-signed-in Chrome omnibox searches earlier this year, and more recently other users who aren’t signed in. We’re going to continue expanding our use of SSL in our services because we believe it’s a good thing for users….

The motivation here is not to drive the ads side — it’s for our search users.

It’s still not clear why Google seems to have ramped up things especially today.

Related Topics: Channel: SEO | Features: Analysis | Google: AdWords | Google: Analytics | Google: Webmaster Central | Legal: Privacy | Top News


About The Author: is a Founding Editor of Search Engine Land. He’s a widely cited authority on search engines and search marketing issues who has covered the space since 1996. Danny also serves as Chief Content Officer for Third Door Media, which publishes Search Engine Land and produces the SMX: Search Marketing Expo conference series. He has a personal blog called Daggle (and keeps his disclosures page there). He can be found on Facebook, Google + and microblogs on Twitter as @dannysullivan.

Connect with the author via: Email | Twitter | Google+ | LinkedIn


Get all the top search stories emailed daily!  


Other ways to share:

Read before commenting! We welcome constructive comments and allow any that meet our common sense criteria. This means being respectful and polite to others. It means providing helpful information that contributes to a story or discussion. It means leaving links only that substantially add further to a discussion. Comments using foul language, being disrespectful to others or otherwise violating what we believe are common sense standards of discussion will be deleted. Comments may also be removed if they are posted from anonymous accounts. You can read more about our comments policy here.
  • Jackinthebox

    How about done to stop spammers (unless they pay for it) who target keywords to build content?

  • makeonlineshop

    Time to use Bing…

  • Tiggerito

    The basic mechanism is that the https search page will not send referrer data over any links. It’s the browsers doing that when in https mode and not Google. However Google have implemented an extra meta tag to request the browser also does not send referrer data when https to https, which by default they will. A deliberate move to stop you keeping your referrer data by switching to an https website.

    I’m not sure how ad links get around this. I know that some tracking is done in the link itself via utm query parameters but I have also read from articles here that somehow ad links send referrer data. Ads and organic links go via a proxy page so Google can store tracking data then redirect the user to the true destination. For organic links the proxy page is secure, but it seems it is not for ads. I’m wondering if same domain links from https to http keep the referrer, and that how they do it. Or the advertisers just get the proxy page as a referrer which still has all the juicy data (passed over an insecure connection).

    It’s clear Google does have control over exactly how much data they pass on via referrer or query parameters. I understand the need to hide the personal data in the referrer parameter, but once that’s gone I’m not convinced removing search terms resolves any privacy issues. But I’m not a lawyer!

  • Vroo (Bruce Leban)

    What makes you think this was done “suddenly”? Turning this on is not a simple matter of adding an “s”. Handling SSL traffic incurs a significant overhead especially at Google scale and there is a lot of work to deploy it. If you look at this without a tinfoil hat, it’s clear that Google has progressively rolled out SSL for searches, first to signed in users and anyone that wants it by using https explicitly, then to chrome omnibox, now to everyone. Kudos to Google.

  • David E Carey

    Today it reports that it will be the 29th of November but it is changing everyday, I would not be surprised if it is in October to be honest.

  • netviper

    Clearly just another thing they are doing to push people to use Adwords if they actually want to know what keywords are driving traffic their websites. I wish Bing or someone would actually take a junk of traffic away from Google. Google will keep on taking and they actually see their market share decline. How much of the first page is even organic anymore!

  • netviper

    Clearly just another thing they are doing to push people to use Adwords if they actually want to know what keywords are driving traffic their websites. I wish Bing or someone would actually take a junk of traffic away from Google. Google will keep on taking and they actually see their market share decline. How much of the first page is even organic anymore!

  • Danny Sullivan

    Because it did happened suddenly, as the spike shows in the story, and especially on the day this was written, when it even went more wide-scale.

  • Vroo (Bruce Leban)

    You’re confusing “turned on over a short period of time” with “Google suddenly decided to do this”. The former does not imply the latter and the word “sudden” implies a precipitous decision or even a knee-jerk reaction to something which you have no data to support. Even saying they “quietly” did this makes it sound like they were trying to keep it secret. Lack of an announcement does not a conspiracy theory make. (Well, maybe a theory, but not an actual conspiracy.)

  • Dario Civinelli

    Oh, look at that! A 302 redirect! Good catch, sir.

  • igl00

    yes they will share data with .gov and fbi now but not with users. really cool!

  • anywherehome

    exactly, blame the fascistic NSA US gov who would make Google enterprise illegal if Google didn’t cooperate = fascistic hidden law made by the fascistic organization = USA

    vote for different parties to avoid that!! otherwise you’re doomed as you vote….your fault

  • Danny Sullivan

    Vroo, when Google first rolled this out, it made a point to announce it. Since then, we’ve had a steady increase but now sudden spike of withholding. But in the past few weeks, Google decided to massively change what it was doing. It was indeed sudden to people outside Google. If Google had been planning for months to make this change in August & September, that kind of doesn’t matter — it’s sudden to us. And it was quiet. This is a much bigger change than the previous one that they did announce. That’s my take; that’s why I wrote it up that way.

  • MikSas

    I am already honing my rusty PPC skillset… I don’t want to rant unnecessarily and bash ‘em. It’s Google’s playground… I am going to play their rules…

  • Alice

    I have not been able to locate Google’s announcement – could someone provide me with an actual Google source for this? Cheers

  • Norm Miller

    Can you share those other methods?

  • Christian Noel

    Google’s motivations are a key component. I could see them coming going to a fully paid subscription model for Google Analytics. Essentially making you pay to a tier for access. Or perhaps in the absence of more paid tiers making the KW data available only in the enterprise version. The fact is they are keeping the data, just not showing us. So it is a fair question to ask what are they going to do with it. Additionally, this latest action by Google is the least transparent thing they have ever done and is the height of hypocrisy given that they are still providing the data to AdWords customers who are basically paying for it. Yet they say it is about “privacy”.

  • Danny Sullivan

    Yes. It’s right up there in the story, where I list the statement Google sent confirming this. That’s the only official confirmation they’ve made, so far.

  • Alice

    Thanks – if that statement is their announcement, I guess they’ve made no ‘official’ announcement, nothing on any of their blogs? I wonder if they were hoping to sneak it past us.

  • Chris Vaughn

    What are the preferred alternate methods for gleaning keyword data?

  • MetaTrader Programming

    I agree with you.

    If you think about it the security of searches is nonsense.

  • Melanie Trudeau

    Seeking the original source for this week’s Google announcement, I ran a Google search for [google encrypting all search data]. Lots of great SEO blogs on page one along with the 2011 post from Google’s blog (cited in this article).

    Seems Google isn’t publishing and ranking their own content on the topic – how ironic! Not sure this 2011 has much relevance any more, so why are they delivering it on page one in the SERPs?

  • seobro

    I use Keyword Discovery to find new niches because Google tools keep getting worse.

  • Kevin Morrison

    “The motivation here is not to drive the ads side — it’s for our search users.”

    This statement from Google really says it all. They claim it is for the security of their users, but as long as you pay for it you can have it. Seems black and white to me, secure it all and honor your claim to secure everyone or secure it unless you want to pay for the information.

    Personally I do not see how what people search for can be classified in the same respect as say my personal verifiable information. With this new security feature I would say that SEO as we have come to know it is dead!

  • Kevin Morrison

    It will not matter what party you vote for, what the NSA is
    doing does not go through the government and in fact they are a ruling body that only answers to itself! Same with the IRS, this government is not out of control as much as it is fragmented and dysfunctional…

  • Kevin Morrison

    LOL… the days of big corporations running the government are long gone. No business, not even the powerful Google or Apple can stop this out of control government from doing anything it wants. You though Hitler was bad? At least we could pin the head on the snake there, what we have created here is a hydra, with many heads and the really scary thing is when you cut off one head, two more grow in its place!

  • Patrick Reinhart

    If you are completely relying on keyword data these days as an SEO then you are in the wrong business. While this will definitely make our jobs more challenging, it isn’t the end of the world. Although I do smell another paid service from Google coming soon…

  • Colin Guidi

    “The motivation here is not to drive the ads side — it’s for our search users.”

    Barf. Thanks Google.

  • MetaTrader Programming

    You know I am surprised that there isn’t more of an uproar about this.

    Imagine for a moment that Google owned the entire process chain of gasoline, and you can *only* buy gas from google?

    Sounds like a monopoly to me, and to my limited knowledge this would be against US antitrust / monopoly laws. So it is surprising the government isn’t blocking the move or questioning it at least.

  • Christian Noel

    Well, here is thing about anti-trust. The only way the government can come after you is if you are abusing your monopoly power. Granted that is a broad threshold, but that is what it is.

    Now your example about Google branding the digital experience entirely to itself: the hardware, OS,Browser, Engine etc is a valid one. However, how is Google abusing it’s power? Taking away KW traffic counts is inconvenient, but doesn’t make it an anti-trust thing.

    There are literally hundreds of SE’s including Bing etc. However, people choose to utilize Google’s. They are free to use whichever they like. You can even find some of the using Google’s SE.

    An anti-trust suit would come to pass if Google pushed out all other browsers off it’s OS outside of Chrome and Firefox and then didn’t allow other search engines to be used or found in its index.

    Anti-trust violations aren’t just based on marketshare. It is more complicated that than that. The nature of Google’s business makes it a murky case

  • MetaTrader Programming

    Thanks for the detailed reply Christian.

    I see your point. Here is my argument how Google is abusing its power:

    (a) Google has the largest market share for search.

    (b) Millions of webmasters depend on knowing what keywords are used to find their websites and for what content to curate in order to rank for their chosen keywords.

    (c) Google now decides to hide the keyword(s) or phrase used to reach the relevant site.

    (d) Now webmasters have no idea at all where the traffic is coming from, Imagine you just spent say $10,000 on a bunch of SEO techniques (document sharing / infographics / videos / articles etc) and now you have absolutely no idea which of the techniques actually worked.

    If I spent $10,000 on several techniques, and I learn that document sharing is a waste of time, and that articles were more effective based on awstats keyword data, then i would obviously reduce spending money on document sharing and increase money spent on articles.

    So this is not just an inconvenience, its going to cost business money that could be spent elsewhere.

    (e) The argument for being able to get keyword data from bing tools or similar isnt really valid because it is not perfectly correlated to google serps.

    (f) Google’s decision will put ahrefs and similar tools out of business. So you would be completely dependant on google for data, and who is to say they are actually giving the correct info (eg the number of links in google webmaster tools is *not* the real number of links a website has, some are hidden from you).

    (g) Google’s decision forces people/business to spend more on Adwords.

    So yeah Google is abusing its position.

    But what can be done? Bend over and take it?

  • MetaTrader Programming

    i made a long and detailed answer. I guess my reply was too touchy for SEL and conveniently deleted it.

    Update: SEL did finally publish my comment (Thanks SEL!)

  • Chris Paterson

    Google is just an ad platform that exists to collect information about people. All of its services are based on this fact. For this reason, I use sites like DuckDuckGo, HushMail, and Ravtree. They don’t violate my privacy.

  • Matt McGee

    Your comment was flagged by the Disqus commenting software, it wasn’t flagged or deleted by us.

    A tip for the future: Start using a real name, not Metatrader Programming, on your Disqus account. Your Disqus activity follows you from site to site and if one site starts to mark your comments as spam (maybe because you’re using a company name), your chances of having comments flagged on other sites goes up.

    Hope this helps.

  • SEO Translator

    I noticed around one month ago that when I typed “” it suddenly became “https”. It also occurs in the “other” (regional) Googles. I found it funny, but did not realize what was behind it. Thanks for enlightening us!

  • Björn Sennbrink

    A “premium” version of Analytics perhaps where you have access to data otherwise restricted under the Not Safe (to Provide) Act?

  • Mike Hastings

    I think you hit the nail on the head Laurel. Also, consider the effects of speak to search – search phrases are becoming full sentences. Semantic search appears to be the next development and the sooner SEO’s understand how they can fit in the sooner they’ll profit from it. is just the start. If you’re looking to get a head start, consider how markup and content will help your sites,

  • Morgan Akchehirlian

    Right their can be two sides of this update.
    One Google take cares of their users and do not want to share their personal data as many users still want to browse secure.
    Second like you said another killing step to make SEO folks life more and more tough.

  • wakason

    I still won’t use Google even with the https. I’ll stick with European search engines that offer stricter privacy.

  • Cyrel Panelo Nicolas

    It’s all business purpose, I guess

  • Kevin Morrison

    Lets think logical and with some higher level of awareness for a moment wakason. Do you think for one moment that any of your online activity is somehow private? We are talking about a government agency that has the power to create money out of thin air and all it takes to control the internet (with a free pass to everything) or as scary as it sounds, the world is money.

    Wake up because the only way you are going to be private is to unplug, move as far as you can from anything remotely controlled by government or some other form of law enforcement. Even then you better bet that if they want to know what you are doing and you speak it or write it down they can!!!

    https does not define security, it is only the illusion of it!!!

  • petervk

    Bing does still show keyword data in its webmaster tools. This whole thing is just major power abuse by Google. The only thing you can do is vote via your search engine usage. I know Bing is still in beta in a lot of countries, but in the US, Germany and France it’s a viable Google alternative IMO. Webmasters and SEO’s talk to a lot of people in general and are true influencers. If the ‘regular’ customer sees an expert in the industry using Bing, it’s a start. Only when the market shifts to more equal percentages (I don’t care whether that’s Bing, Yahoo, Ask or whatever) will we see more healthy behavior by Google.
    However, most people will say to my post: well, as if Google cares I don’t use them anymore…matter of fact is: they do, a lot.

  • Faiz Ahmed Faiz

    I guess not provided is the future if we stick to Google.

  • Faiz Ahmed Faiz

    Danny, I just hope you were not drunk when you wrote this article. “Done to block the NSA??” You serious mate?? The company which repeatedly said and implied that they dont give a damn about user privacy took such a big step to enhance privacy?

    Come on, you might like Google but lets not be this much blatant.

    PS: bashing expected from Danny lovers :)

  • SEO Manager

    They are the same!

  • MetaTrader Programming

    Yes thats true. However the keyword data from Bing is not representative of Google SERPS, which makes it harder.

    I do agree with your points though.

  • The SEO System

    I think Google may be being slightly disingenuous here, especially on point #1. The NSA? Are we to infer that Google will no longer have this data available to themselves and then, by extension, cannot provide it to the NSA?

  • Twizor Technosolutions

    Yes I agree with you..

  • Kenneth von Rauch

    It’s kida pity to see where it’s going to, but since we still can see what pages/content is driving traffic…. so far so good.

  • Sergiu Draganus

    Google want us to think we get a benefit from this but, Secure Search & keyword encryption has nothing to do with the non-provided issue . Google Analytic is not a third party server, it is also a Google server which can see ( decrypt ) the keywords, but probably this decision will drive more and more users to pay for keyword data by running AdWords campaigns to test CTR and conversions.

    Monitoring Rankings seems to be a good alternative, but now over 75% of the keywords are generating different rankings on Google SERPs based to the user IP address. Same site can rank in NY on 1 st position and in LA – not listed in Google top 100 for the same keyword.

    One of the best approaches to keyword data as a KPI is to compare the no of local searches for a certain keyword provided by the Google Keyword Planner tool with the Local Rankings ( GeoRanker can provide this ) and try to figure out an algorithm to estimate traffic as 1st position 50% of the traffic, 2nd position 20% and so on.

    Would love to brainstorm on this idea. Any other thoughts about it?

Get Our News, Everywhere!

Daily Email:

Follow Search Engine Land on Twitter @sengineland Like Search Engine Land on Facebook Follow Search Engine Land on Google+ Get the Search Engine Land Feed Connect with Search Engine Land on LinkedIn Check out our Tumblr! See us on Pinterest


Click to watch SMX conference video

Join us at one of our SMX or MarTech events:

United States


Australia & China

Learn more about: SMX | MarTech

Free Daily Search News Recap!

SearchCap is a once-per-day newsletter update - sign up below and get the news delivered to you!



Search Engine Land Periodic Table of SEO Success Factors

Get Your Copy
Read The Full SEO Guide