The World Is Freaking Out About Data Privacy, and DuckDuckGo Is Ready to Seize the Moment

DuckDuckGo founder Gabriel Weinberg. Illustration by Israel Vargas

Gabriel Weinberg swears there’s no Batman-esque origin story that inspired him to become Privacy Man, a superhero who protects citizens from the evil globo-corporations that want to abuse our personal information for profit. There was no mother barging into his teenage room as he yelled “Mom! Privacy!” that set him on his intrepid — and possibly insane — crusade of competing against Google by creating a rival, privacy-shielding internet search engine, all by himself, in his unfinished Chester County basement.

“I don’t have an emotional moment when it all came together, a great turning point of identity theft or something,” he says during a recent Zoom call from the same basement, no longer unfinished.

There was, however, that thing he did when he was 12.

In 1991, Weinberg, while in the sixth grade, began exploring online bulletin-board systems and figured out how to set up his own. With this newfound power, he created a way for his father, an infectious-disease doctor, to answer people’s questions about HIV and AIDS.

“It offered anonymous access to ‘Dr. Brick,’ which was my dad,” he remembers. “We had a time of the week where there were ‘office hours.’” It was an experience that stuck with him, even if the seed took years to sprout.

“Search should be one of the most private spaces on the internet,” he says, “because people are typing in their most sensitive problems and issues.”

Weinberg, 41, looks a little like vintage Elvis Costello has joined your fantasy baseball league. He doesn’t present like a guy who might soon be your friendly neighborhood billionaire. He speaks softly and processes his thoughts for multiple nanoseconds before answering a question.

“It’s just the right policy move for our society to have privacy,” he says. “I’m sorry; I studied technology and public policy. You’re gonna get more intellectual answers from me.”

Web users’ privacy wasn’t yet the big idea when Weinberg launched his home-brewed search engine, DuckDuckGo, amid the modest Philly tech scene of 2008. He was 29 and had arrived in Greater Philadelphia with the kind of quiet swagger that a master’s degree from MIT and selling your previous company for $10 million can bring. And he believed he could beat Google at its own game.

Battling against Google in web search sounds like a suicide mission — like trying to lower the ocean with a soup spoon. Then as now, almost no business on the planet has been so dominated by one company. Google these days has 91 percent of the global search engine market, according to web analytics service Statcounter, which clocks DuckDuckGo at 0.6 percent.

“Search should be one of the most private spaces on the internet,” says Weinberg, “because people are typing in their most sensitive problems and issues. It’s just the right policy move for our society to have privacy.”

But something has started to happen, and 2021 may bring a breakthrough for DuckDuckGo after years of under-the-radar growth. Digital privacy, the feature that has evolved into this little engine’s core attraction, is finally starting to freak people out enough for them to do something about it.

In a 2019 Pew survey, 62 percent of U.S. adults said they considered it impossible to go through daily life without having data about them collected by companies. In November, the firm EY Global reported that “54 percent of consumers say that COVID-19 has made them more aware of the personal data they share than they were before the pandemic.” Which has to be the virus’s weirdest symptom.

At a 2019 U.S. Senate Judiciary Committee hearing, personal data even had Lindsey Graham and Amy Klobuchar singing the same tune as they grilled a Google lawyer while attempting to understand how search engines turn personal data into billions of dollars. Weinberg testified at that hearing, telling the senators: “The American people are pretty much tired of being tracked online everywhere they go. They’re tired of the invasive ads, data breaches, discrimination and manipulation.”

Weinberg told the senators it’s possible to make a decent living offering web search the old-fashioned way, without collecting user data. He also said, “In many ways I come to you from the future,” hinting that a less intrusive online life might someday be possible, if maybe somebody somewhere took Congressional action.

As the dying days of Apocalypse 2020 offered glimmers of hope for civilization, the debates over digital privacy brought some promising tech news, as if the government had finally heard him. In October, the U.S. Department of Justice filed an antitrust complaint against Google for “anticompetitive and exclusionary practices” in the search and search advertising markets. Two more government antitrust lawsuits against Google followed in December. California already has a consumer data protection law. It’s becoming likely that the lawsuits might do something further to rein in Google’s dominance of search.

DuckDuckGo (let’s just say DDG) handled 23 billion search queries last year. It’s a cute little massive number — Google surpassed two trillion annually a few years ago. But DDG has been profitable since 2014, is gaining brand awareness, and is adding users by the millions. Its traffic rose 62 percent last year. In the United States, per Statcounter, it’s become the number two search engine on mobile phones, which now account for 60 percent of all searches. The privately held company says its revenues topped $100 million in 2020. (Google reported more than $160 billion in 2019.) More than one tech observer has suggested DDG might be a good acquisition target for Apple.

“You can run a darn good business by dislodging a tiny, tiny percentage of Google’s business,” says Cindy Cohn, executive director of the Electronic Frontier Foundation, a digital user rights organization.

Weinberg, however, isn’t thinking tiny.

“The percentage of people who, if they could press a button and get privacy on the internet … that’s probably 50, 60, 70 percent,” he says. Moving into 2021, DDG is focused on converting growing consumer awareness into action, making it easy and sacrifice-free for people to switch their default search engines and to utilize other privacy protection offerings. “The reality is, if you can get one percent, you probably can get 10 percent in this market. Or 20 percent,” he says.

There’s nothing cute or tiny about that.

To understand the opportunity DuckDuckGo faces, you need to understand how personal data is collected — and why people are increasingly paranoid about its use.

Maybe it all began — the jolt of awareness that our most private information is actually bare to the world — in 2013. That’s when Edward Snowden blew the whistle on the National Security Agency’s habit of secretly gathering millions of Americans’ phone records.

Then came the steady drumbeat of news about data breaches at Target, Equifax, Marriott and other companies, exposing millions of our credit card and Social Security numbers to criminals. Suddenly we were hearing identity-theft horror stories from people we knew.

Then came those creepy ads for, say, the shoes that you just searched for online that have followed you to every website you’ve visited since. How? And Cambridge Analytica weaponizing psychographic data, harvested from our Facebook clicks, in an effort to sway the 2016 election.

At the heart of the issue — and what Graham and Klobuchar were trying to unravel in that Senate committee hearing — is the difference between behavioral advertising and contextual advertising.

On DuckDuckGo, if you search for, say, “herpes relief,” you’re shown ads for creams, pills, and an assortment of natural remedies. DDG doesn’t know what brands you might have bought before or posted a selfie of yourself using, because it doesn’t know who you are in the first place. Every time you arrive to make a search, you’re a stranger.

DDG advertisers pay to be displayed next to specific terms; their ads are anonymously served from Microsoft’s network, and DDG makes its money displaying millions of them. That’s contextual advertising. No personal information is shared with the advertiser or Microsoft. Your DDG web search is never recorded, and the record of your IP address self-destructs like a Mission: Impossible tape afterward.

Then there’s behavioral advertising, which relies on Google collecting and knowing an unnerving amount of stuff about each of its users. For instance, if I visit myactivity.google.com, I can see a chillingly comprehensive record of my online activity. And over at adssettings.google.com, I can see about a hundred things they think they know about me, so they can serve up ads for stuff I’m likely to click on. Put another way, if you’ve ever searched for herpes cream, Google knows, and it knows your brand.

The data tracking, however, goes beyond advertising and seeps into the information we’re shown and, ultimately, how we view the world.

I recently Googled “Hunter Biden” — purely for research purposes. The results I got were links to media that I read regularly: CNN, Wikipedia, Axios, the Hill, BBC, the New York Times, Politico. Google personalized my links because it knows me — the searches I’ve done, web pages I’ve visited, ads I’ve clicked on, YouTube videos I’ve viewed.

Then I searched for Hunter Biden on DuckDuckGo. The results included NBC News, CNN and Politico, but also Fox News, the New York Post, PJ Media and Patriots for Truth. Those are, broadly speaking, the same links that everybody using the platform presumably gets — DuckDuckGo’s search results are actually provided by Microsoft Bing — ranked by calculated relevance but not by relevance to me in particular.

The custom-tailored set of facts you often get in a Google search has been called the “filter bubble.” Facebook and cable TV news made it famous, but this filtering effect also happens billions of times a day thanks to the most common way people seek information online.

Of course, we all curate our own bubbles, and I have to admit, sometimes I don’t mind being inside mine. It’s comforting. Sites seem to work a little more seamlessly when your information follows you around. After years of searching with Google, you develop an innate sense of what information you’re going to get. Learning to use a tool that has no idea what you want can actually feel frustrating. What’s wrong with a service knowing you better to serve you better? Do you really want to be a stranger everywhere you go?

“Really, so many of these questions are framed around privacy, but they’re really about control,” says the Electronic Frontier Foundation’s Cohn. “The idea that privacy means nobody knows anything about you, that’s kind of a recipe for a Unabomber, right? Privacy is really about who gets to see, and who gets to control, and what information about you is available.”

Not long ago, I discovered Google Maps Timeline. It shows me, on a map, everywhere I’ve traveled, every minute of my life, while carrying my Android phone in my pocket. My reaction was deeply mixed: This is the creepiest thing ever, and also, it’s the coolest thing ever.

“I wish we had a word for that,” Cohn says, “where something is awesome and creepy at the same time.”

With Google, Facebook, and other useful, free services, we make that trade-off with every click. We accept a range of privacy infringements: the ones that we freely agree to by sharing our personal stuff, the ones we unintentionally consent to by not reading the fine print, and the ones we may read about in a lawsuit someday.

In Google’s 31-page user privacy policy, you can learn that the company collects “things you create or provide to us … like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos.” Google tracks you when you’re using its own products and when you’re using other sites around the ’net. The EFF says Google code runs on about 85 percent of sites on the web.

But it goes deeper. Google in 2019 agreed to pay $13 million to settle a lawsuit after admitting that its vehicles photographing neighborhoods for Street View collected emails and passwords from wi-fi networks. That “incognito” mode in the Chrome browser? It doesn’t automatically stop websites from tracking you. And Wirecutter reported that if you installed a pre-owned Google Nest indoor camera, the previous owner might have a way to access it (an issue Google has since fixed).

Harvard professor Shoshana Zuboff, in her 2019 book The Age of Surveillance Capitalism, writes that the Nest thermostat “uses motion sensors and computation to ‘learn’ the behaviors of a home’s inhabitants. Nest’s apps can gather data from other connected products such as cars, ovens, fitness trackers and beds.” It’s all uploaded to Google’s servers.

As users, we’re expected to make sense of complex data-sharing settings and terms-of-service contracts. Good luck. The web of personal data exchanged via today’s “Internet of Things” is so intertwined, Zuboff writes, citing University of London research, that “were one to enter into the Nest ecosystem of connected devices and apps … the purchase of a single home thermostat would entail the need to review nearly a thousand so-called contracts.”

There’s a user-rights website called Terms of Service; Didn’t Read that aims to bring transparency to what sorts of data collection we consent to when clicking on sites’ legalese-laden contracts. How much control are we keeping and how much are we surrendering when we “agree”? Terms of Service; Didn’t Read gives A ratings to only four sites, one of which is DuckDuckGo, which hasn’t changed its privacy policy substantially in the 12 years since it was founded.

Up around the Massachusetts Institute of Technology, across the river from Boston, students create tech start-ups and solicit money from angel investors as routinely as the rest of us go for Starbucks. Gabriel Weinberg, born in Washington, D.C., and raised in suburban Atlanta, arrived at MIT in 1997 already bearing an entrepreneurial streak.

He got a physics degree and started brainstorming ideas for tech ventures and working with start-ups before entering a master’s program in technology and public policy. One idea was an educational website, Learnection, which he claims failed not because of the terrible name but because in 2000, it was “15 years too early.”

One Weinberg success was Names Database, a social directory he created in 2003, around the time Mark Zuckerberg was developing Facebook over at Harvard. Names Database grew partly out of Weinberg’s experiments with search. He posted dummy pages with made-up combinations of common names just to see what would happen, and those pages started coming up among top search results when people searched for old friends who happened to have those names. He took this as evidence that people wanted a service to reconnect them with old friends. Working with one partner and no employees, Weinberg signed up users and wrote code. In 2006, Classmates.com purchased Names Database for $10 million. He feels that worked out well.

Gabe Weinberg at the DuckDuckGo headquarters in Paoli. Photograph courtesy DuckDuckGo

“Facebook kind of took over social networking, so it didn’t really make sense to stay in it,” he says. “Also, I didn’t like it. It turns out that I’m not really interested in social networking. Not a Facebook user.”

When his wife got a job at GlaxoSmithKline in Collegeville, she and Weinberg relocated to the Philadelphia area. Feeling isolated in the boonies, he started a Philly tech meetup group to find other “people building stuff.” He became an early mover in the Philly tech start-up scene, investing in some ventures and bouncing ideas off people.

“He was working on 25 or 30 ideas,” says Brad Denenberg, part of that circle as co-founder of another networking group and now a fixture in the local start-up scene. “Gabe is one of the most deliberate thinkers, incredibly analytical. He will test and validate and have the data to back up anything.”

Denenberg says he admires how confidently Weinberg maintains a low profile: “I remember a party, it might have been something that First Round Capital was throwing, and he just sat alone in the corner. And I was like, ‘Gabe, you got like 50 guys here that are worth a billion dollars. Go work the room.’ The other young entrepreneurs were running around frantically. But that’s not him.”

Several projects coalesced into DuckDuckGo. Weinberg wrote code that combined Yahoo search tools with his own crawling of websites. He filtered out spammy junk links. He developed a way to pluck answers out of Wikipedia and present them in a box on the results screen as Instant Answers, an innovation Google now offers. Storing people’s search histories or browser fingerprints wasn’t something he was interested in. No one needed to sign up or log in.

There’s no thrilling story about the name DuckDuckGo. “I knew I wanted to have a fun mascot logo, so I was just thinking of names,” he says. “It popped into my head on a walk with my wife, and we both liked it.” Given that his competition — Yahoo, Google and Bing — would be an excellent name for a clown trio, we’ll let this slide.

He debuted his site in September 2008, posting the link on a forum called Hacker News with one line: “What do you think of my new search engine?” The immediate feedback was useful:

Your name is bad.

Your text is too big.

I’d suggest going to Google, writing down every difference between their user interface and yours, and asking yourself why you did it differently.

Fellow hackers praised his search results and his “balls” but wondered what the point was. He answered them: “Quite simply, I looked at the current state of search and saw a path through which I could add something useful to the space. There are all sorts of issues with current search. … Relevancy is certainly one of them, but there are others too, e.g. spam, clutter, discovery, and UI.”

The word “privacy” appeared nowhere in the post. So maybe it was a bit of revisionist history when he wrote, in his 2015 start-up advice book Traction: How Any Startup Can Achieve Explosive Customer Growth: “I could tell some people were growing wary of what Google was becoming. Those initial conversations led me to investigate search privacy and eventually become ‘the search engine that doesn’t track you.’”

Still, in 2010, DuckDuckGo doubled in growth, from 1.2 million searches per month to 2.5 million. And people started wondering if Weinberg actually intended to make a run at Google. An interviewer in 2011 asked him: “Do you really want to compete with Google, or are you just making a point or playing around?”

“My goal since the beginning is to be the primary search engine for as many people as possible,” he replied. “So no, I’m not playing around.”

In 2011, when he was asked what was wrong with Google, he cited “spam, irrelevant results, clutter and privacy.” That year, Weinberg did elevate privacy as an opportunity to differentiate — and to poke the beast. He paid $7,000 for a billboard in San Francisco that announced, “Google tracks you. We don’t. Search better at DuckDuckGo.com.”

It got attention, including a think piece in Wired, because the companies that thrive in Google’s Silicon Valley backyard are a little more cautious about taunting the giant. Weinberg noticed similar geopolitics when he sought outside funding for the first time, in 2011.

“Going after Google was enough to get meetings with people, but most people’s reaction was, like, ‘No thanks,’” he says. He talked to more than 40 venture capital firms, and the three that sent him offer sheets were all outside Silicon Valley.

“I think the mentality of data collection is pervasive in Silicon Valley,” he explains. “There is just an ethos of data collection and monetization there. And a lot of those people sell their companies to Google, so they don’t want to back something that attacks Google. On the East Coast, 3,000 miles removed, there’s less of a pull into the Google reality-distortion field, if you will.”

Union Square Ventures in New York, which put $3 million into DDG, figured Google’s reliance on turning our lives into marketing data could be a competitive opportunity. The partners there recalled how in the 1990s, Microsoft’s dominance was challenged by antitrust litigation but undone more thoroughly by evolution. Microsoft had so much revenue tied up in selling packaged software that it couldn’t respond nimbly to free alternatives on the internet. Now, Google is so invested in collecting user data that it can’t really make true privacy fit its business model.

“Gabriel’s insight was that people would start to get freaked out by how much data is being collected by the search engines,” says Union Square founding partner Brad Burnham. “He had figured out how to create this differentiated consumer experience on a relatively tiny amount of money. The theory was, the only way you’re going to be able to compete with Google is to do something that they would not do. You change the game.”

When the DOJ’s first antitrust lawsuit against Google dropped in October, it created a small buzz at DuckDuckGo, though it wasn’t exactly a surprise. “It was coming any day now for what felt like three months,” says Kamyl Bazbaz, DDG’s vice president of communications. The suit listed Google’s three U.S. competitors as Microsoft’s Bing (which has 2.7 percent of the search market), Yahoo (1.5) and DuckDuckGo.

“I was excited about it. You know, one of those companies is not like the others,” says Bazbaz, who used to be a communications consultant for Sesame Street. But he says Weinberg was more blasé about being included in that major-league lineup: “Gabriel is really not the type to pat himself on the back.”

The focus now is on seizing opportunities created by the general paranoia over privacy that’s been amplified by the official complaints. Weinberg in 2018 hired his first in-house counsel, Megan Gray, an attorney who brought tech privacy cases while working for the Federal Trade Commission. “Now that the [Google] lawsuits are actually filed in the United States, a lot of my time has been spent trying to proverbially get our ducks in a row with coming subpoenas and depositions,” Gray tells me. “I see DuckDuckGo as being the star witness in a lot of these cases.”

One crux of the DOJ complaint is that Google pays billions of dollars a year to phone makers and service providers to be the default search engine on phones. Google reportedly pays Apple as much as $12 billion a year to be the default search for its Safari iPhone browser. “Largely as a result of Google’s exclusionary agreements and anticompetitive conduct, Google in recent years has accounted for nearly 90 percent of all general-search-engine queries in the United States, and almost 95 percent of queries on mobile devices,” the DOJ suit says.

Google responded that nobody forces anyone to use its search. Consumers can change factory settings with a few clicks, and “this lawsuit … would artificially prop up lower-quality search alternatives, raise phone prices, and make it harder for people to get the search services they want to use.”

Gray thinks a legal remedy could involve a “preference menu,” a required setup screen on phones and computers through which users select a default search engine from a list, rather than passively accepting the factory-installed one. Europe has this for mobile phones (though critics there claim that regulators, in letting Google implement the remedy, dropped the ball).

On phones, DDG offers an app that isn’t just a search engine but rather a full-fledged web browser — an alternative to Safari or Google’s Chrome. The DDG browser blocks trackers, the little digital breadcrumbs that websites and apps try to plant to follow us around. The idea is that instead of using Facebook’s own mobile app, a user could visit Facebook’s website inside the DDG app, which would act like a protective membrane.

The DDG browser also has a little icon called the Fire Button, a one-touch “clear history” that closes all your open tabs and deletes any data that was stored on your phone by the sites you visited, activating with a satisfying going-up-in-flames animation. Beah Burger-Lenehan, a former Google staffer who joined DuckDuckGo as its first product director in 2019, works on features like this, designed to make privacy feel less difficult. The browser app moves DDG beyond search, establishing it as more of a privacy company. On desktop computers, it offers a browser extension that allows users to retain Google search but block trackers, and the company’s future innovations may be more geared toward leaving no trace than search.

DuckDuckGo has set a high standard, and it can’t afford a lapse. Its most fervent customers are privacy absolutists, sort of like Bernie Sanders acolytes or MAGA heads, who take pride in their evil-detection capabilities. (If you want to barf a little, visit the DuckDuckGo Community page on Facebook.) Last July, there was blowback when an “ethical hacker” discovered DDG was storing little icons for websites people visited (“favicons”) on its servers. You call that privacy?

Weinberg explained that it was done for technical reasons and that nobody was being tracked. But the indignant pushback wouldn’t let up. A website accused DDG of being “a privacy abuser in disguise.” The company revised its code.

With tens of millions of customers now, DuckDuckGo has grown far beyond that hard-core base, though they’re a loyal constituency. DDG exceeded 100 million searches in a day for the first time on January 11th — right after Twitter banned Donald Trump, the news broke about Whats­App sharing user data with Facebook, which sent various “freedom”-­seeking users flocking to alternative digital platforms like Gab and Signal.

According to various industry observers and metrics, the company may be close to transforming into one of those mythical beasts called a unicorn — a private company valued at $1 billion. To the suggestion that DuckDuckGo could be a juicy Apple acquisition target, Weinberg says that’s not something he’s thinking about. But one way or another, he could become one of those billionaires at fancy tech parties.

It’s easy to underestimate the importance of web searching, how it works, and who controls it. It’s more than a technology or a market. Web search is a selective gateway to knowledge and ideas for billions of people. To own even a piece of it is to have hands on some important levers.

“Search straddles an increasingly complicated territory of marketing, media, technology, pop culture, international law, and civil liberties,” wrote John Battelle, co-founding editor of Wired magazine, in his 2005 Google history book The Search: How Google and Its Rivals Rewrote the Rules of Business and Transformed Our Culture. “It is fraught not only with staggering technological obstacles … but nearly paralyzing social responsibility.”

So I wonder about the other thing DDG does besides privacy — actually its main purpose, which is to deliver information. In early January, days after the attack at the U.S. Capitol that was fueled by misinformation, I searched the phrase “election stolen.” Google served my usual news sources that debunked phony claims. On DuckDuckGo, four of the top five results, unfiltered by any bubble, were links suggesting the election had been stolen by Biden.

If the internet is jeopardizing truth as much as privacy, does a growing search engine have any responsibility to check the information it conveys? DuckDuckGo has waddled into that divisive issue without really addressing it. A lot of its customers come for the lack of “censorship.” Weinberg says the absence of filtered results at least lets everybody see the same information.

“It’s a nuanced question of what to do on any given query. There’s no silver-bullet answer,” he says. “I don’t think it should be us drawing that line on particular content.”

He admits that accuracy is an even tougher nut to crack. I guess he needs to leave something for the next disruptive web search start-up to figure out.

Published as “Your Privacy Is Safe With Me” in the March 2021 issue of Philadelphia magazine.