Skip to content
No snoopin' !

Private: some search engines make money by not tracking users

DuckDuckGo and Ixquick take a tiny bite out of Google.

Cyrus Farivar | 78

In the United States, two out of every three searches go through Google, which serves up a total of three billion search queries per day. "Googling" has become so ubiquitous that the company has become a verb in English (and in other languages, too).

Given that most of us use Google several times a day and may also use it to send e-mail, to plan our calendar, and to make phone calls, questions commonly arise about how all of that data is used. Google has said that it needs access to such large amounts of data as a way to “make it useful” and to sell personalized ads against it—and to profit substantially in the process.

However, a March 2012 study from the Pew Internet and American Life Project found that two-thirds of Americans view a personalized search as a “bad thing,” with 73 percent of those surveyed saying that they were “not OK” with personalized searches on privacy grounds. Another recent poll of California voters recently reached similar results, as “78 percent of voters—including 71 percent of voters age 18-29—said the collection of personal information online is an invasion of privacy.”

Short of masking your online trail with a VPN or going through Tor all the time, it’s hard to avoid the watchful eye of Sergey and Larry. What's a privacy-conscious Web searcher to do? For those who worry about such issues, privacy-minded search alternatives in various stages of development do exist—even if they're only taking the tiniest bite out of Google, Microsoft, and Yahoo’s search engine market share.

DuckDuckGo

DuckDuckGo often previews Wikipedia at the top

One of the top privacy search engines has a name reminiscent of a children’s game: DuckDuckGo. The site was founded two years ago but has recently taken off; just last month, it hit an all-time record of 1.5 million searches per day and its daily search traffic has grown by 227 percent in three months.

So what does DuckDuckGo do differently, besides putting up cheeky billboards in San FranciscoDuckDuckGo works by using both its own Web crawler and data from other search engines, including Yahoo, Bing, and Blekko—but not Google. The company claims not to log IP addresses or user agents, and “no cookies are used by default." It also uses default encryption modeled after HTTPS Everywhere.

“Not really knowing about [what the other guys do], we independently made the decision that we wanted to go down this route of not storing this data,” explained Gabriel Weinberg, the site’s founder, in an interview with Ars this month.

“Search engines have a history of getting subpoenas, and Google has been more and more open to the requests that they were responding to," he said. "It seemed inevitable that search engines would get requests from law enforcement—I don’t like that idea of handing over data.”

Beyond that, the company started operating a Tor exit enclave not long after it launched, allowing traffic headed for the DuckDuckGo search engine to exit the Tor network.

“That makes it easier for people on Tor to hit our search engine and it means that we don’t store stuff and you can ensure that it exits through us. You can be end-to-end anonymous on Tor,” Weinberg added.

How does a site that makes a point of not tracking its users make money? Through contextualized search ads that generate “sponsored links.” Not that Google's money machine should start to worry yet; Weinberg says that his for-profit company earned around $115,000 in revenue in 2011—with three employees and a handful of other contractors.

But Weinberg says he's patient. He believes that users will ultimately come to DuckDuckGo because it’s a “better search experience,” not just because of privacy.

“The problem is that [people] have never had a choice,” he said. “They don’t perceive that they have a choice. If you say: yes, you can go to this privacy search engine, they feel that they’re sacrificing something for that. But I don’t want to hamper my search experience. We’ve been trying to offer high privacy and a comparable or better search experience [than Google].”

Weinberg’s not the only one saying it. Search Engine Land wrote last month that in terms of user experience and interface, DuckDuckGo “has begun to beat Google at its own game.”

Beyond search watchers, privacy watchers have also taken notice. Nicole Ozer, the technology and civil liberties policy director at the Northern California office of the American Civil Liberties Union (ACLU) in San Francisco, told Ars that she’s been watching DuckDuckGo for some time.

“Our position is that [the public] shouldn't have to choose between using new technology and keeping control of our personal information,” she said.

Privacy-conscious Internet users may wonder about the verifiability of DuckDuckGo's claims. The short answer is that there isn’t any good way to know if DuckDuckGo (or any other company) does what it says, short of the company releasing its source code. Weinberg has not submitted DuckDuckGo to an outside security audit, as he argues it would not add much in terms of convincing skeptics, but he notes in an online post that a company breaching its own privacy policy can lead to prosecution or sanctions from the Federal Trade Commission.

For many users, this is enough. “DuckDuckGo would be pretty dumb to breach their own privacy policy; their privacy policy is clear and unambiguous and leaves them little wiggle room,” a user called D.W. posted in an online security forum a month ago.

Ixquick

Ixquick returns similar results to Google

DuckDuckGo isn’t the first player in the private search game. Founded in the US back in 1998, Ixquick claims that it’s the “world’s most private search engine." In 2000, it was acquired by a Dutch company.

Like DuckDuckGo, Ixquick says that it does not use any tracking cookies and that it does not record IP addresses. As of May 10, 2012, the company also says it has stopped recording user agents entirely and has deleted all previous user agent records. The company generates results using search data from multiple other engines, rather than using its own Web crawler. (It offers similar protection for its traffic obfuscating front-end for Google, Startpage.com)

“The only information we log are total search numbers conducted per language and the general browser type used,” wrote Katherine Albrecht, the spokesperson for Ixquick, in an e-mail to Ars.

The company says that it has been certified and audited by Certified Secure and by the Dutch data protection authority. In 2008, Ixquick received the first European Privacy Seal (Europrise), awarded by the organization of the same name, which bases its extensive criteria (read the 60 page document [PDF]) on the privacy protections in the northern German state of Schleswig-Holstein.

Ixquick says that it serves two million searches per day, a bit higher than DuckDuckGo (but if the latter continues its rise, it may soon overtake Ixquick). Like DuckDuckGo, Ixquick earns revenue by selling contextual ads at the top of the search results page, but Ixquick’s spokesperson declined to disclose the company’s annual revenue.

Both companies sell sponsored links, which are generated based on an automated scanning of search terms (and which is not logged). So, for example, a search for "iPhone" on both sites yields a paid link (marked as such) near the top of the search.

“We can report that we are fiscally sound and have been profitable since 2004," Albrecht said. "Ninety-nine percent of the money we earn comes from the ads we show on our results pages. While serving non-personal ads is less profitable than serving ads based on tracking customers' search history and personal interests, we feel it is a far more ethical model on which to build a company. Our income not only lets us pay the bills, but it has also allowed us to pursue ambitious plans to expand our privacy product offerings.”

Minnows before the whale

Other privacy-focused, non-commercial, and for-profit companies and search projects exist, but most are small (see, notably, Constant Crawl and the forthcoming Gooey Search) and still in development.

One interesting project out of France, the Seeks Project, seems to have the most fully verifiable solution, as it releases all of its source code under the AGPLv3 license. The site takes a client-based solution to locally personalize search results obfuscated through a peer-to-peer network.

“The client is also a proxy, which means that all your Web traffic goes through this before it hits the Internet,” explained Emmanuel Benazera, the project's creator, to Ars. “Whatever comes back to your browser is witnessed by the local client. We’re moving the software closer to you, then we can do more by working locally.”

Given that the Seeks Project doesn’t log its traffic, developers don't know for certain how many people are using the service so far. However, Benazera said that on its French site, the project serves about 12,000 searches per day.

Still, all of these companies and projects are going to have a tough time competing on a financial or search volume level with Google—which still serves more than three orders of magnitude more searches than DuckDuckGo or Ixquick.

“It’s a tiny, tiny amount,” Danny Sullivan, editor of Search Engine Land, told us when asked about the relative volumes. "I’m far more concerned about the quality of search results, but I’m glad that we have those alternatives out there. Some people want to feel like they have the ability to do a private search and so it’s nice to have those alternatives.”

UPDATE: Katherine Albrecht of Ixquick wrote to us on Friday to add: "We have also experienced tremendous growth, more than doubling our traffic in the last three months to hit an all-time record of 2.4 million searches. We are a fast-growing, thriving company with a bright future, not a company about to be 'overtaken.'"

Photo of Cyrus Farivar
Cyrus Farivar Editor at Large
Cyrus is a former Senior Tech Policy Reporter at Ars Technica, and is also a radio producer and author. His latest book, Habeas Data, about the legal cases over the last 50 years that have had an outsized impact on surveillance and privacy law in America, is out now from Melville House. He is based in Oakland, California.
78 Comments