Yahoo Search is the search service of Yahoo Inc., majority-owned by Apollo-managed funds since 2021 (Verizon retains 10%). Yahoo's privacy policy (updated March 2026) covers search alongside Yahoo Mail, AOL and other properties: it collects search queries, device identifiers and location, may recognize users who are not signed in, and associates activity across devices for targeted advertising. Its search-services notice says search queries and IP addresses may be shared with third-party search partners. Yahoo operates ConnectID, a cookieless ad identity graph built on logged-in signals; its California notice lists identifiers, network activity, geolocation and inferences among categories sold or shared, with an opt-out and Global Privacy Control recognition. The Yahoo! Inc./Altaba era left the 2013 breach of ~3 billion accounts, a $35M SEC penalty and a $117.5M class settlement.
TRACK RECORD
1 BREACH · 2 ENFORCEMENT ACTIONS
BREACH LEDGER
[2012-07-11] · BREACH
Have I Been Pwned lists a breach record for Yahoo Search: "Yahoo".
Approximately 453,427 accounts affected, per HIBP.
In the Yahoo! Inc. Customer Data Security Breach Litigation (N.D. Cal. Case No. 5:16-MD-02752-LHK), covering data breaches from 2013 through 2016, the court granted final approval on July 22, 2020 to a class settlement under which the defendants agreed to pay a $117,500,000 settlement fund providing credit monitoring and cash payments to U.S. and Israeli Yahoo account holders.
On April 24, 2018, the U.S. Securities and Exchange Commission announced that Altaba Inc., the entity formerly known as Yahoo! Inc., agreed to pay a $35 million penalty to settle charges that it misled investors by failing for nearly two years to disclose the December 2014 breach in which hackers stole usernames, email addresses, phone numbers, birthdates, encrypted passwords and security questions for hundreds of millions of user accounts.
Yahoo publishes a Privacy Dashboard and per-brand privacy controls page where users can customize how their information is used and, after signing in to authenticate, download, delete or manage the personal information Yahoo holds about them.
The Yahoo Privacy Policy (last updated March 2026), which covers Yahoo Search along with Yahoo's other consumer properties, states that Yahoo collects device information, search queries, location information and payment data, may recognize users or their devices even when not signed in, and may use device IDs, cookies and signals obtained from third parties to associate accounts and devices with a user.
Yahoo Inc. maintains a public transparency report site stating that it publishes information twice a year on government requests for user data and how it responds, along with annual reporting on its efforts against child sexual abuse material and EU Digital Services Act disclosures.
In a May 3, 2021 press release, Verizon and Apollo Global Management announced that funds managed by Apollo affiliates agreed to acquire Verizon Media — comprising the Yahoo and AOL brands — for $5 billion, with Verizon retaining a 10% stake and the company to be known as Yahoo at closing; the current Yahoo Inc. is therefore a privately held, private-equity-controlled company that does not file public SEC periodic reports.
Yahoo's California Consumer Privacy Act notice (last updated December 2025) states that across its products Yahoo sells or shares categories of personal information with third parties including identifiers, contact information, internet or electronic network activity, geolocation information and advertising-related inferences, while stating that Yahoo does not sell or share information that on its own identifies a person, and offering a control to opt out of the sale or sharing.
Yahoo's search-services privacy page (last updated June 2026) states that various third-party search partners help provide Yahoo's search and search-advertising results, and that Yahoo may share a user's search query, IP address and other pseudonymous browser or app identifiers with these search partners, who may use them, along with search-result clicks, for advertising, search product improvement, research and fraud detection.
In an October 3, 2017 press release, Yahoo (then part of Verizon's Oath) announced that, based on a forensic investigation after the Verizon acquisition, it believed all Yahoo user accounts — the company's December 2016 disclosure put the total at approximately three billion accounts existing in 2013 — were affected by the August 2013 data theft, expanding its earlier estimate of more than one billion affected accounts.
On April 24, 2018, the U.S. Securities and Exchange Commission announced that Altaba Inc., the entity formerly known as Yahoo! Inc., agreed to pay a $35 million penalty to settle charges that it misled investors by failing for nearly two years to disclose the December 2014 breach in which hackers stole usernames, email addresses, phone numbers, birthdates, encrypted passwords and security questions for hundreds of millions of user accounts.
In the Yahoo! Inc. Customer Data Security Breach Litigation (N.D. Cal. Case No. 5:16-MD-02752-LHK), covering data breaches from 2013 through 2016, the court granted final approval on July 22, 2020 to a class settlement under which the defendants agreed to pay a $117,500,000 settlement fund providing credit monitoring and cash payments to U.S. and Israeli Yahoo account holders.
In a June 2, 2025 Yahoo Inc. blog post, the Head of Product at Yahoo DSP described Yahoo ConnectID — Yahoo's first-party advertising identity solution built on logged-in signals — as active across publishers representing nearly 90% of total ad spend in the Yahoo DSP, integrated with LiveRamp, Magnite, Prebid and Amazon Publisher Services, and designed to deliver targeting in cookieless environments such as Safari, Firefox and connected TV.
Yahoo's California Consumer Privacy Act notice (last updated December 2025) states that Yahoo recognizes legally recognized browser-based opt-out preference signals, naming Global Privacy Control, in accordance with and to the extent required by applicable law.
The Yahoo Privacy Policy (last updated March 2026) states that Yahoo matches and serves targeted advertising across devices, both on and off Yahoo services, based on device activity, inferred interests and location information, and associates a user's activity across Yahoo services and different devices under a single user ID.