AFAIK this doesn't shut off the search leakage in the referrer header.

That's a feature of how the internet works at an architectural level. How exactly is that Google's fault?

If you don't want referral headers to be sent from one website to another, use HTTPS, or turn it off in your browser.

Unfortunately, normal people don't know how to turn them off or use the https version. Google could do a lot of things to make this easier.

The best would be to just prevent ad networks from collecting this personal information altogether. The only reason I've heard against doing so is that webmasters need search terms for SEO, but they can get them via Webmaster tools.

Failing that, they could make a setting in the http version that turns off the headers. They could also make a setting that defaults to https. And they could make https easier to get to. Currently you can't even do https://google.com/ (you have to type in www.)

> Google could do a lot of things to make this easier.

And so could Microsoft, Mozilla, Apple, and Opera.

As others have mentioned, this is a good marketing move, but it's not clear to me that you actually care that much about this issue.

Having spoken to Gabriel offline, because I was building my own search engine, he cares quite a bit about this issue. A ton of us in tech clain to care about privacy, but very few of us put their balls (and actions) where their beliefs are. DuckDuckGo's privacy policy has been in place for quite some time. And, it's only been recently that he's advertised it.

Anyone who really cares can - and will - use HTTPS.

EDIT: It appears that at least one person disagrees with me. So, a quick question: Which takes more effort for the end user, switching to a new search engine or switching to https?

In the last few weeks, I've talked to a lot of people that care. And in general people do care: http://blogs.wsj.com/digits/2010/12/21/web-surfers-troubled-...

I can tell you that normal people who care also don't know about HTTPS or how to use it. I'm all for Google making it easier to do so, or otherwise stop this personal information from leaking. See http://news.ycombinator.com/item?id=2122431 for some ideas.

Also, FWIW, HTTPS alone doesn't solve the issue completely, as HTTPS->HTTPS traffic still leaks.

Actually, with Google Instant, the search terms aren't in the URL anymore - does it still leak?

Yes. See http://news.ycombinator.com/item?id=2063961

Not if you use Opera.