Yes, DuckDuckGo Has a Microsoft Problem

Posted on May 26, 2022 by Paul Thurrott in Cloud, Web browsers with 12 Comments

In an interesting online exchange, DuckDuckGo CEO and cofounder Gabriel Weinberg admitted that his firm’s web browser is forced to allow Microsoft trackers through. But despite the outrage—after all, DuckDuckGo promotes its products and services for their privacy prowess—it’s not as bad as it looks.

It all started on Twitter, of course.

“Sometimes you find something so disturbing during an audit, you’ve gotta check/recheck because you assume that something must be broken in the test,” privacy and data supply chain researcher Zach Edwards tweeted. “But I’m confident now. The new DuckDuckGo browsers for iOS/Android don’t block Microsoft data flows for LinkedIn or Bing.”

He later added that both mobile browsers claim to “automatically block hidden third-party trackers.” And that DuckDuckGo transparently reports this issue on its website, where you can discover that the firm partners with Microsoft and that, as a result, “ad clicks are managed by Microsoft’s ad network.” That page links to Microsoft’s privacy policy, and DuckDuckGo explains there that Microsoft collects a lot less data than do other search engines, presumably Google.

“When you load our search results, you are completely anonymous, including ads,” he tweeted in return. “For ads, we worked with Microsoft to make ad clicks protected. For non-search tracker blocking (e.g. in our browser), we block most third-party trackers. Unfortunately, our Microsoft search syndication agreement prevents us from doing more to Microsoft-owned properties. However, we have been continually pushing and expect to be doing more soon.”

I guess we could debate whether Microsoft tracking you is “better” than Google doing so—and given their relative market positions, I will argue it’s less serious, for sure—but the bigger issue, perhaps, is what the alternative is. And that’s pretty clear: you should be using anti-tracking extensions no matter which browser you’re using. That’s easy enough on desktop, but the situation on mobile is a bit murkier since most mobile web browsers don’t support extensions. But that’s starting to change.

(You may recall that I quickly ran afoul of the new Microsoft Edge’s tracking protection functionality when the browser launched two years back. Long story short: if you want to be protected against trackers, you can’t just trust that particular browser.)

Given that DuckDuckGo is transparent about its behavior with regard to its Microsoft partnership, I’m not sure this deserves the level of outrage you can see in the Twitter comments. But if you’re concerned about online privacy, it’s important to know about this and what your options are. And it appears that with DuckDuckGo, yes, Microsoft is “tracking” you. But you are anonymous, which I feel lives up to the letter of its privacy claims.

Tagged with ,

Join the discussion!


Don't have a login but want to join the conversation? Become a Thurrott Premium or Basic User to participate

Comments (12)

12 responses to “Yes, DuckDuckGo Has a Microsoft Problem”

  1. SherlockHolmes

    Havent we all a Microsoft problem?

    • wright_is

      More or less, it depends on where you put Microsoft in the trust matrix.

      Much better than Google or Facebook, worse than Apple and much worse than rolling your own open source.

      But my trust in Microsoft is diminishing every month, with each new case of over reach or security and privacy blunders.

  2. webdev511

    uBlock and Privacy Badger along with NoScript or another script blocking extension to minimize the leakage. Better yet, PiHole...

    • Chris_Kez

      I'm not sure that combination of tools is fully applicable for mobile, which is what this kerfuffle is about.

      • dftf

        Not-sure about iOS, but on recent-versions of Android (Pie 9.0 or later) you could probably use the "Secure DNS" feature (DoT) to filter-out domains you don't want your device to connect to. (Obviously that won't-work for any apps which specify an IP-address to connect to, rather than a hostname, but it should block most connections.)

      • gartenspartan

        Those extensions are all available on the mobile version of Firefox for Android.

  3. jeffrye

    I've been using Neeva. It's not ad supported which would insulate them from the issue Duck-Duck-Go is having with Microsoft. As long as we're the product instead of the customer, we shouldn't be surprised at things like this.

  4. Sykeward

    DuckDuckGo may have a Microsoft problem, but Microsoft also has a Microsoft problem. Microsoft makes a lot of hay about privacy, trust and trustworthiness, security, etc. I think a big reason why they’ve avoided the regulatory ire that other tech companies are facing now is because they’re generally viewed as a good corporate citizen.

    That’s why it’s a problem that they keep getting caught lately in these self-created messes. With this, it doesn’t really matter that it’s technically less bad than it looks at first glance (it’s still not great), or that it’s still better than Google or Meta (where untrustworthiness is just part of their reputations). Microsoft is actually burning goodwill with each controversy—I have to admit that I trust them less than I did a year ago, and I’m not sure I would believe them now if they said they were recommitting to privacy.

  5. Finell

    I would not say that DDG is "transparent" about anything. They did not say a word until an outsider caught them. Before they were caught, they lied to everyone.

    • lvthunder

      Did they lie or did no one read the fine print?

      • jackwagon

        I do kind of wonder whether they put it in the fine print knowing that most people would never think to look there. I guess it could be a form of deception by obfuscation, rather than standard lying or deceiving by omission.

  6. Jeffsters

    the bigger issue, perhaps, is what the alternative is…” that would be Mac OS and iOS.