That's a problem as more and more Americans look to take control of their privacy online.

In the past six months, many have been rudely awakened by the lack of privacy within the behemoth data platforms of Facebook and Google. A recent report by Pew Research Center found that a majority of Americans are significantly changing their relationship with Facebook, with about half taking breaks from the platform in one way or another.

But as Facebook usage wanes, messaging apps like WhatsApp are growing in popularity as a "more private (and less confrontational) space to communicate." That shift didn't make much sense to us because both services are owned by the same company, so we tried to find an explanation. It turns out that a striking percentage of American adults actually don't know that Facebook owns WhatsApp. 😱

We randomly selected 1,297 random U.S. adults (not just DuckDuckGo users) who are collectively demographically similar to the general population of U.S. adults (see methodology below) and surveyed them on August 16th, 2018. Half of those who used WhatsApp in the past six months (247 U.S. adults) weren't aware that Facebook owns WhatsApp.

And it doesn't stop there. We also found that nearly 60 percent of those who used Waze in the past six months (291 U.S. adults) didn't know that Google owns Waze. 🚨

This means that a majority of Americans who are using WhatsApp and/or Waze are doing so without realizing that all of their information, whether it be routes, travel time, messages, photos, or location data, is privy to Facebook (for WhatsApp) and Google (for Waze).

As Waze states in its privacy policy:

Waze may also share personal information with companies or organizations connected or affiliated with Waze, such as subsidiaries, sister-companies and parent companies (i.e. entities that belong to the Google group of companies).

If that's not creepy enough, the social component of the Waze app means that the app is also able to collect information like your voice recordings, chats you have with friends within the app, and contacts within your cell phone.

And as was recently made clear when WhatsApp's original co-founder left the company this past April, the threat Facebook poses to WhatsApp user privacy is significant.

The lack of awareness over Facebook and Google's reach is even more alarming as more and more Americans are looking to take control of their privacy online, but don't have the information to make conscientious choices. It misleads people into believing they can avoid the treacherous waters of Google and Facebook privacy practices by standing in a smaller stream like Waze or WhatsApp, without knowing each directly flows into the very same oceans they attempted to escape.

This new survey is similar to our April 2018 findings that found that 56.90% (± 2.86%) of American adults were unaware that Facebook owns Instagram and 44.67% (± 2.87%) did not know that Google owns YouTube.

Methodology

These results are based on the polling of a random sample of 1,297 American adults (18+) on August 16th, 2018 via SurveyMonkey's Audience platform, which ensures the demographic make-up of respondents is representative of the U.S. population. Survey respondents were paid and a confidence level of 95% was used for calculating the values above.

For more privacy advice, follow us on Twitter & get our privacy crash course.

Consumers are increasingly facing privacy invasions wherever they turn: hyper-targeted ads and massive data breaches are now daily occurrences, along with their unfortunate consequences (ad discrimination, identity theft, spreading misinformation, filter bubbles, etc.). As a result, the demand for online privacy is growing - and it's growing fast. As an internet privacy company, we've felt the effects of this demand firsthand at DuckDuckGo.

In the wake of Facebook's Cambridge Analytica scandal, we hit our all-time high daily direct search record - a whopping 25,568,558 private searches. And since this year, we're proud to report that our apps and browser extensions - DuckDuckGo Privacy Essentials - now do more than just private searching. They also come packaged with best-in-class tracker blocking, smarter encryption, and website privacy grades - all the privacy essentials you need on any device with just one download.

Despite our progress this year, we've still got more to do to advance our vision of raising the standard of trust online. Today, we're announcing a partnership with OMERS Ventures (OV), part of the $95 Billion global OMERS pension fund, based in Canada. Their expertise, shared interest in privacy, and investment in DuckDuckGo will help us continue expanding our privacy protections across the globe.

DuckDuckGo has been a profitable company since 2014 without storing or sharing any personal information of our users. By partnering with OMERS, we hope to bring our profitable privacy-centric business model to more places.

This partnership comes at just the right time as the need for privacy continues to grow globally. In a July 2018 survey of 667 Canadian adults, we found that 43% have taken a significant online privacy action, such as installing "browser extensions to block web trackers."

Additionally, 53% of Canadians say that having a search engine that "didn't collect any personal data about me or my searches" would be among the top two motivations to switch search engines. Privacy is alive and mainstream in Canada, just like in many other parts of the globe.

We hope to be able to report continued progress in helping Internet users across the globe protect their privacy. We believe the internet shouldn't feel so creepy (right?) and it's our mission to empower people with seamless tools to take control of their personal information online, without any tradeoffs.

For privacy advice, follow us on Twitter & get our privacy crash course.

Over the years, we at DuckDuckGo have often heard a flawed counter-argument to online privacy: “Why should I care? I have nothing to hide.”

As Internet privacy has become more mainstream, this argument is rightfully fading away. However, it’s still floating around and so we wanted to take a moment to explain three key reasons why it's flawed.

1) Privacy isn’t about hiding information; privacy is about protecting information, and surely you have information that you’d like to protect.

Do you close the door when you go to the bathroom? Would you give your bank account information to anyone? Do you want all your search and browsing history made public? Of course not.

Simply put, everyone wants to keep certain things private and you can easily illustrate that by asking people to let you make all their emails, texts, searches, financial information, medical information, etc. public. Very few people will say yes.

2) Privacy is a fundamental right and you don't need to prove the necessity of fundamental rights to anyone.

You should have the right to free speech even if you feel you have nothing important to say right now. You should have the right to assemble even if you feel you have nothing to protest right now. These should be fundamental rights just like the right to privacy.

And for good reason. Think of commonplace scenarios in which privacy is crucial and desirable like intimate conversations, medical procedures, and voting. We change our behavior when we're being watched, which is made obvious when voting; hence, an argument can be made that privacy in voting underpins democracy.

3) Lack of privacy creates significant harms that everyone wants to avoid.

You need privacy to avoid unfortunately common threats like identity theft, manipulation through ads, discrimination based on your personal information, harassment, the filter bubble, and many other real harms that arise from invasions of privacy.

In addition, what many people don’t realize is that several small pieces of your personal data can be put together to reveal much more about you than you would think is possible. For example, an analysis conducted by MIT researchers found that “just four fairly vague pieces of information — the dates and locations of four purchases — are enough to identify 90 percent of the people in a data set recording three months of credit-card transactions by 1.1 million users.”

It’s critical to remember that privacy isn't just about protecting a single and seemingly insignificant piece of personal data, which is often what people think about when they say, “I have nothing to hide.” For example, some may say they don't mind if a company knows their email address while others might say they don't care if a company knows where they shop online.

However, these small pieces of personal data are increasingly aggregated by advertising platforms like Google and Facebook to form a more complete picture of who you are, what you do, where you go, and with whom you spend time. And those large data profiles can then lead much more easily to significant privacy harms. If that feels creepy, it’s because it is.

We can't stress enough that your privacy shouldn’t be taken for granted. The ‘I have nothing to hide’ response does just that, implying that government and corporate surveillance should be acceptable as the default.

Privacy should be the default. We are setting a new standard of trust online and believe getting the privacy you want online should be as easy as closing the blinds.

For more privacy advice, follow us on Twitter & get our privacy crash course.

We are proud to share that we've just donated $500,000 to 21 privacy organizations that share our vision of raising the standard of trust online. Each year, we donate to privacy-focused organizations, though this year we're exceptionally excited because an additional $142,482 was donated by 2,113 individuals like you as a part of the DuckDuckGo Privacy Challenge Crowdfunding Campaign, meaning a grand total of $642,482 was raised to help advance privacy rights and tools.

In the wake of the Cambridge Analytica Facebook incident, people are actively seeking out ways to protect their online privacy.

In this context, we're proud that many of you took the additional step to directly support the organizations that tirelessly protect your online privacy. And just as importantly, through your efforts on social media and beyond, we were also able to increase awareness of these important projects:

• Demand Progress: $76,571.28 from us, $32,415.73 from you
• Freedom of the Press Foundation: $68,012.06 from us, $23,900.22 from you
• Center for Democracy and Technology: $48,021.72 from us, $18,868.00 from you
• Fight for the Future: $44,663.88 from us, $16,575.56 from you
• Tails: $38,080.52 from us, $9,870.27 from you
• Restore the 4th: $32,903.87 from us, $9,242.61 from you
• New Media Rights: $33,809.97 from us, $5,971.00 from you
• The Tor Project: $22,815.69 from us, $5,206.49 from you
• The Calyx Institute: $14,325.04 from us, $4,597.70 from you
• Terms of Service; Didn't Read: $18,895.49 from us, $3,515.00 from you
• Let's Encrypt: $14,236.34 from us, $3,500.10 from you
• Riseup Labs: $11,560.75 from us, $1,395.00 from you
• OSTIF: $11,532.67 from us, $1,360.00 from you
• Access Now: $10,903.07 from us, $805.00 from you
• Emerald Onion: $10,401.30 from us, $1,320.00 from you
• Internet Freedom Festival: $11,088.54 from us, $1,070.00 from you
• Privacy Rights Clearinghouse: $9,078.78 from us, $1,040.00 from you
• ACLU Foundation: $6,928.78 from us, $870.00 from you
• Freenet Project: $6,633.78 from us, $575.00 from you
• World Privacy Forum: $4,263.78 from us, $205.00 from you
• Bits of Freedom: $5,272.82 from us, $180.00 from you

For more privacy advice, follow us on Twitter & get our privacy crash course.

And 45% Don't Know That Google Owns YouTube

In the wake of news about Cambridge Analytica obtaining the personal data Facebook kept on 50 million Americans, #DeleteFacebook went viral. And, as our recent survey revealed, about 60 percent of Americans plan to share less information with Facebook and nearly 40 percent are now more likely to delete their Facebook accounts. But there’s one big problem: a majority of Americans don’t know that Facebook also owns Instagram.

We surveyed 1,153 random U.S. adults (not just DuckDuckGo users), who collectively are demographically similar to the general population of U.S. adults. Surveys were taken on Mar 26th and 27th, 2018.

We found that 56.90 percent (± 2.86%) of respondents were unaware that Facebook owns Instagram.

And the problem isn’t just limited to Facebook/Instagram. We also found that almost half of the American population (44.67 ± 2.87%) did not know that Google owns YouTube.

Why is this a problem? Case in point:

In reaction to #DeleteFacebook, we’ve seen many disengage with Facebook in favor of Instagram, seemingly without realizing that the same company would be handling their personal data.

Quite simply, people who are unaware of the corporate parent ownership of Instagram and YouTube cannot make informed privacy decisions about using them. Facebook and Google amass huge data profiles about people, and can each combine Instagram or YouTube data into these profiles, respectively, further enabling hyper-targeting on their ad platforms.

Add to that the troves of data they’re already collecting on you through their massive tracker networks lurking behind most of the sites you visit, and the question then becomes what don’t they know about you instead of what do they know.

Bottom line: if you want to disengage fully with Facebook, you also need to disengage with Instagram, and also block Facebook's web trackers.

Methodology

These results are based on the polling of a random sample of 1,153 American adults (18+) on March 26th and 27th, 2018 via SurveyMonkey's Audience platform, which ensures the demographic make-up of respondents is representative of the U.S. population. Survey respondents were paid and a confidence level of 95% was used for calculating the values above.

For more privacy advice, follow us on Twitter & get our privacy crash course.

Survey Results from 1,153 Random U.S. Adults

Over the past week and a half, there has been a lot of excellent media coverage detailing how Cambridge Analytica was able to easily download the sensitive personal information of 50 million Facebook users after only getting questionable authorization from 270,000 people.

We wanted to understand how much awareness there has been of this incident and what behaviors and attitudes may have changed among those who are aware. To that end, we commissioned a survey of 1,153 random U.S. adults (not just DuckDuckGo users), who collectively are demographically similar to the general population of U.S. adults. Surveys were taken on Mar 26th and 27th, 2018. Here are the results.

Awareness

We found that 85.34% +/- 2.04% of U.S. adults are aware of the Cambridge Analytica incident.

Deleting Facebook Accounts

Among those who are aware and who currently have a Facebook account, 37.00% +/- 3.39% state that they're now more likely to delete their Facebook account.

Sharing Less Personal Information with Facebook

Similarly, among those who are aware and who currently have a Facebook account, 60.82% +/- 3.42% plan to share less personal information with Facebook.

Trust in Facebook

More than half (56.00% +/- 3.10%) of those who are aware of the incident disagree with the statement, "I trust Facebook to take appropriate action to protect it's users' online privacy."

Regulation of Facebook

42.58% +/- 3.09% of respondents who are aware of the Cambridge data incident agree with the statement, "I believe the government should play a greater role in regulating how Facebook handles user data." Add to them the 21.44% +/- 2.56% who are neutral, and a solid majority (64.02% +/- 3.00%) are not opposed to the regulation of Facebook.

These responses differ significantly from those who haven't heard of the incident. 42.58% +/- 3.09% of those that have heard of the incident responded that they somewhat agree, agree, or strongly agree with the statement above. Compared with 30.18% +/- 6.92% of those who haven't heard about the incident, the relative change between those groups is 41.10% +/- 25.11%.

Concern for Online Privacy

Moving beyond Facebook, among those who are aware of the incident, 64.23% +/- 2.99% responded that they're now more concerned for their online privacy as a result of the event.

Seeking Tools/Services to Protect Online Privacy

Roughly half (51.12% +/- 3.12%) of those polled who are aware of the Cambridge Analytica incident are now more likely to seek out tools and services to protect their online privacy.

Even if you delete your Facebook account or stop visiting the website entirely, trackers from Facebook still lurk on about 25% of websites. Facebook can still use this tracking to create a "shadow" profile about you, and target ads at you via their audience ad network off of Facebook, or if you still use Facebook somewhat, use the browsing history they see to target ads at you on their site.

Privacy Tip: To prevent this ad targeting and additional data collection, you need to use a tracker blocker extension/app, like the one offered by us (DuckDuckGo) on all major browsers and platforms that also includes additional privacy essentials.

In Summary

In just a week and a half, the Cambridge Analytica incident has had a major impact on Americans' sentiment toward Facebook and online privacy. We expect continued shifts in attitudes and behaviors about Facebook and other services as coverage continues to scrutinze poor privacy practices, and the dialogue turns to what we can do about them.

Methodology

These results are based on the polling of a random sample of 1,153 American adults (18+) on March 26th and 27th, 2018 via SurveyMonkey's Audience platform, which ensures the demographic make-up of respondents is representative of the U.S. population. Survey respondents were paid and a confidence level of 95% was used for calculating the values above.

For more privacy advice, follow us on Twitter & get our privacy crash course.

DuckDuckGo and Vivaldi Partner on Private Browsing Mode.

As regular readers of this blog will know, but sadly most people still do not, Private Browsing modes generally don’t prevent online tracking of your searches, and this includes everything you type into Google. Private browsing modes are designed to erase history information on your computer, but don’t do much to prevent the sites you visit from tracking and monitoring your behavior to build up personal profiles.

In addition, searches in Private Browsing mode are usually performed using the default search engine. This means a non-private search engine will continue to use tracking methods such as collecting your IP address or browser fingerprinting. So really that Private Browsing mode isn’t so private after all.

Recently we gave our browser extensions a boost with more features that are meant to protect you, bundling essential privacy features such as tracker blocking and an encryption protection feature that automatically sends you to an encrypted version of a website (if there is one), instead of accepting a default non-encrypted version.

We continue to focus on expanding our privacy ecosystem by partnering with premium privacy companies to offer private search. Our most recent exciting news is that we have partnered with Vivaldi Browser to help them become the first browser to enable private search by DuckDuckGo as the default in their Private Window mode.

Why is this important?

The first thing many people do when opening a Private Window is search the web. Unfortunately they immediately expose themselves to tracking if they are not using DuckDuckGo. Now in Vivaldi, the moment you start using private browsing mode, your search is private as you'd expect — no need to change anything. Your searches and personal information will not be collected or shared while using Private Windows, in addition to the privacy protection features that Vivaldi gives you by default.

With users often keeping default settings in software, this addition to the latest version of Vivaldi is an important step towards both convenience and privacy.

For more privacy advice, follow us on Twitter & get our privacy crash course.

Help double our donations and support online privacy.

The campaign has now finished. Thank you to all those who donated and please continue to support these organizations that work for our privacy.

We're excited to announce that we're donating half a million dollars to non-profits that share in DuckDuckGo's vision of raising the standard of trust online, and we need your help!

Since 2011 we've donated $800,000 to projects that are working to spread Internet privacy, and this year we're taking it up a notch with the DuckDuckGo Privacy Challenge crowdfunding campaign. With your participation via donations and spreading the word, we could dramatically increase the amount of money that's donated to these amazing organizations.

Starting today, we're supporting more than 20 non-profit organizations through a massive privacy crowdfunding campaign hosted by CrowdRise, the world's biggest fundraising platform for charitable giving. Suggestions for the participating organizations were crowdsourced from you, the DuckDuckGo community, and all of these impactful projects either directly enable you to be more private online, or help defend your rights to online privacy. You can explore their work from the campaign page here: https://www.crowdrise.com/duckduckgoprivacychallenge.

How it works

From now through April 10th, we'll be running this friendly crowdfunding campaign for organizations committed to protecting the privacy of personal information on the Internet. The projects will compete for $500,000 in prizes to help further their missions.

In particular, we will match every donation received online by each participating organization, up to $3,000. We will also award 16 grand prizes, with $50,000 to the organization that raises the most money during the challenge. Finally, each organization can also benefit from weekly bonus challenges whose prizes total $247,000.

Your donations will directly impact the funding each organization can receive, hopefully leveraging our $500,000 to much more than we can achieve individually.

How you can help

It's easy to get started:

• Visit the DuckDuckGo Privacy Challenge page, or view the individual profiles from the list below to support the work of these organizations.
• Please spread the word to increase awareness of the DuckDuckGo Privacy Challenge. The more you share, the greater the impact we can all make for these wonderful organizations. You can share the CrowdRise challenge URL (https://www.crowdrise.com/duckduckgoprivacychallenge) with your network via email or on social media (with the hashtag #FundPrivacy2018).
• If you make a donation, let your online community know about it and encourage them to consider doing the same.

Over the next four weeks, we can make a huge impact together, ensuring better privacy for you, your family and friends, and Internet users worldwide. Thank you for your participation.

• Access Now
• Bits of Freedom
• Center for Democracy and Technology
• Demand Progress
• Emerald Onion
• Fight for the Future
• Freedom of the Press Foundation
• Freenet Project
• Internet Freedom Festival
• Let's Encrypt
• New Media Rights
• OSTIF
• Privacy Rights Clearinghouse
• Restore the 4th
• Riseup Labs
• Tails
• The Tor Project
• Terms of Service; Didn't Read
• The Calyx Institute
• World Privacy Forum

For more privacy advice, follow us on Twitter & get our privacy crash course.

In a previous post we saw the effect of encryption, trying to make content unreadable to anyone watching your traffic. Great, you may think, my DuckDuckGo searches are safe! Yes, but only if it's really DuckDuckGo at the other end of your connection. There are two parts to sending information securely over the Internet, whether it's private messaging, private web browsing or any other private data transfer, and encryption is only half the story.

• Encryption: Encoding the information so that it can't be read by anyone without the correct key.
• Identity verification: Verifying that the person or thing at the other end of the connection is really who they say they are.

Security certificates play a vital role in this verification and you may have seen warning messages in your browser about certificates being out of date or somehow incorrect. Let's look at how these certificates are used so you can hopefully have more trust in your online interactions and make informed choices when warnings appear.

What is a certificate and who checks it?

Like everything on your computer or device, certificates are just files containing data. They're relatively small and contain details such as their date of issue and expiry, what domain they're valid for, who issued them and a supposedly unique, unfakeable "signature" made of letters and numbers called a hash^*.

In some ways a security certificate is like a passport for a website — it verifies its identity — but you can't be expected to examine the certificate of every server (computer) on the web so, thankfully, your browser does that for you in the background. It's like your own personal passport control official. Every website you try to securely connect to has to present its certificate to your browser which makes various checks. If something's wrong such as the certificate being expired, its domain name not matching the one you're trying to access, or an incorrect signature, your browser will either show you a warning or simply block the site completely. As you can see, we place incredible trust in the browsers we use everyday but how do they know who to trust?

Who issues the certificates?

Browsers can't be expected to know about every certificate on the Internet so instead they rely on core Certification Authorities (CA) — organizations that are verified by browser vendors. All browsers contain a list of certificates issued by trusted CAs called root certificates and they're the foundation of a chain of trust consisting of further certificates. Similar to a national passport issuing authority, the certificate issuers should make proper checks to verify the details of the people or organization controlling the website requesting a security certificate. The security of the Internet relies on this chain of trust and there are serious consequences if it's ever at risk, as was seen in April 2015 when a major root certificate authority was removed from browsers after the discovery of a rogue certificate. Incidentally it is possible to make your own "self-signed" certificate, just as it's possible to create your own passport, but it won't be officially recognized.

Isn't it possible to spoof the certificates?

Certificates rely on various things to be secure and trustworthy — the strength of the algorithm to create the signature and the competence of the issuing authority, for example. These naturally improve over time as knowledge and research findings spread, just as weaknesses in older methods appear. There have been cases of certificate spoofing and there may be again, but the likelihood is ever-decreasing.

So certificates make everything OK?

They're a great technology and work well. The fact that most people don't know of their existence despite using them every day shows how elegantly the system works. However, as long as there are systems to protect us there are people trying to defeat that protection. In the case of security certificates, there have been instances of ISPs, workplaces and even computers and tablets intercepting secure Internet connections using their own certificates. Instead of a single secure connection to your bank, for example, there might be a secure connection to your ISP and then a separate secure connection to your bank. Technically it seems secure but actually traffic is intercepted presumably without the user's knowledge. Fortunately the security community is full of helpful experts who look out for such untrustworthy behavior and spread the news quickly so it can be fixed (or avoided). It's also possible to check certificates yourself if you get suspicious.

How can I check certificates myself?

Usually within your browser you can click on the small padlock image next to the address bar, which only appears for secure sites, i.e. those beginning with https://. Then there should be a button to open the details of the certificate for you to view. Make a point of checking who the issuing authority is, what domain it's for (hopefully the one you're visiting!), when the expiry date is, and so on.

So with your newly-acquired certificate skills, what should you do? Well, nothing really. Continue to use the Internet as you normally do, albeit with hopefully a better understanding of the technology in place to protect you. If you do come across a certificate warning, however, now you should be able to investigate and decide for yourself how best to proceed. It may be a simple blog with a certificate that expired yesterday, or it may be a suspicious domain that's masquerading as your bank. Either way, it's good practice to let the website owners know and do your bit to keep everyone safer on the Internet.

Recommended reading: What is SSL and what are Certificates?

^* A hash is created from some content in a one-way process so that any change to the content would generate a different hash. For example, imagine burning a printed document and closely examining the remaining ashes. If you edited, re-printed and burnt the document again the chemical composition of the resulting ashes would be (ever-so-slightly) different. It's also impossible to discover the content of the document just by examining the ashes, which is the same as with a hash.

For more privacy advice, follow us on Twitter & get our privacy crash course.

When surfing the web, you want to keep your personal information private, not leaving it open to be spied on by Internet Service Providers or other people on your network. For this purpose, an increasing number of websites and services are using secure web connections, shown by a padlock or similar indication in your browser's address bar. Such websites use "https://" at the beginning of their address rather than "http://". Think of it as automatic encryption. But what protection does that give you? How much of your surfing data is secure?

To find out, I'm going to use packet analyzing software to spy on myself as I browse the web and see what information is visible. Such software makes it possible to capture and examine traffic on a network, seeing the raw data that is sent between devices. The software I'm using is called Wireshark, which is free and open source, but there are many other similar tools available. The following is a crude test but I hope to show what that little padlock means in most circumstances.

General content

Firstly let's look at the content of a basic web page. The standard example website used by many tutorials is example.com which helpfully has both an encrypted (secure) and unencrypted version. The content is simply a short message and a link saying "More information." In Wireshark I searched for the word "information" and this is the result:

As you can see, it found the word "information" together with the rest of the page's content. In other words, everything I can see in the browser is also easily visible to anyone sharing my network or spying on my connection.

With the secure version, however, the content is encrypted and although Wireshark shows lots of packets of data, it's not clear what they contain.

Domains

Now we've seen the effect of a secure connection, let's see what other information it hides starting with the most fundamental — the domain name. This is the part of the web address (URL) that ends in .com, .org or similar. I'm switching websites this time and capturing data packets when I visit duckduckgo.com which is secure by default — we can tell by the "https://" at the beginning of the address. Looking at Wireshark's results, I quickly find a data packet containing the domain name, as you can see:

It may be surprising that the domain name is clearly visible but not only is it normal, it's essential. Without it, your router and Internet servers beyond wouldn't know where to send your requests for web pages. It's a bit like the luggage tag that's put on your suitcase when you check in at an airport — it needs to be visible for the various staff to send it to the right city.

Sub-domains

Sub-domains are areas within a domain. If we stick with the airport analogy, they're the equivalent of having one or more airports within a city. Consequently sub-domain names, for example safe.duckduckgo.com, are also visible within data packets even over a secure connection.

Individual pages

This is where things get reassuring. Like your luggage when it arrives at an airport, there's no need for its subsequent precise destination to be public. In the case of data packets, only the server at the destination domain (or sub-domain) should be able to decrypt the precise destination and so directory and page names are therefore not visible to external observers. This includes other parameters in the address such as ?query=keyword#target.

Form data

Finally, what about web forms which are often used for sensitive personal data? Sometimes this is sent as part of a web page's address, in which case we now know it's safely encrypted. Many times it's not however, and is sent by the browser passing on your information in the background. Fortunately this is treated similar to other content and encrypted when a secure connection is used. In fact when checking data packets I was not even able to tell what was form data, what was a page name and what was regular content. This is how it should be when data is encrypted.

Being careful

So as you can see, it's simple to summarize what data is protected when using a secure web connection:

• Domain and sub-domain in the URL: Unencrypted, i.e. visible
• Remainder of the URL: Encrypted, i.e. hidden
• All other page and form data: Encrypted, i.e. hidden

You may think you don't need such protection and that Internet spying only happens on a large scale or to high-profile people, but in fact when you're in a cafe, hotel, workplace or even in your own home, it's still possible for someone to monitor your data as shown in this experiment. Using secure web connections is an easy way to increase your privacy.

Unfortunately you can only use a secure web connection with websites that support it. DuckDuckGo search is secure by default of course, but there are many websites that aren't. However, we've released a browser extension and mobile app that will make sure encryption is used when available (in addition to other privacy features). It works in the background, silently redirecting you to secure connections when it can. We recommend installing it for your regular mobile and desktop web browsing, as well as keeping an eye on the address bar to look out for that padlock.

For more privacy advice, follow us on Twitter & get our privacy crash course.

Today is the 11^th annual Data Privacy Day. If you're going to make real progress in your data privacy this year, you must do something about your Google and Facebook use. Here's why and how:

I've also covered this in more detail in this op-ed on CNBC.

As explained above, here are the steps to take back your privacy online:

• Live Google-free with our recommendations for alternatives to Google services.
• Reduce your Facebook usage as much as possible. I've personally been living Facebook-free for many years.
• Get the DuckDuckGo browser extension and mobile app that blocks Facebook and Google hidden trackers and contains other privacy essentials: additional tracker blocking, smarter encryption, private search, and more.
• Make your devices more private with our device privacy tips.

Happy Data Privacy Day!

For more privacy advice, follow us on Twitter & get our privacy crash course.

DuckDuckGo moves beyond search to also protect you while browsing.

Over the years, DuckDuckGo has offered millions of people a private alternative to Google, serving over 16 billion anonymous searches. Today we're excited to launch fully revamped versions of our browser extension and mobile app, extending DuckDuckGo's protection beyond the search box to wherever the Internet takes you.

It’s hard to use the Internet without it feeling a bit creepy – like there’s a nosey neighbor watching everything you do from across the street. Except, instead of a nosey neighbor, it’s a vast array of highly sophisticated tracker networks, run by big companies like Google and Facebook, recording everything you do online, often without your knowledge, and selling their findings to the highest bidder via targeted ads. While closing the blinds at home can put a stop to your neighbors, there isn’t something that simple that can work online. Until now.

Today we’re taking a major step to simplify online privacy with the launch of fully revamped versions of our browser extension and mobile app, now with built-in tracker network blocking, smarter encryption, and, of course, private search – all designed to operate seamlessly together while you search and browse the web. Our updated app and extension are now available across all major platforms – Firefox, Safari, Chrome, iOS, and Android – so that you can easily get all the privacy essentials you need on any device with just one download.

The DuckDuckGo browser extension and mobile app will also now show you a Privacy Grade rating (A-F) when you visit a website. This rating lets you see at a glance how protected you are, dig into the details to see who we caught trying to track you, and learn how we enhanced the underlying website's privacy measures. The Privacy Grade is scored automatically based on the prevalence of hidden tracker networks, encryption availability, and website privacy practices.

To date, cobbling together an effective privacy solution has required researching complicated technologies, installing multiple add-ons and apps on each device, and often worsening your Internet experience. Others have been unfortunately misled by supposed simple solutions. Think “Incognito” mode blocks Google from watching what you’re doing? Think again. Private browsing modes are marketed to make you think that if it's not in your device’s browser history, it never happened. Sadly, that couldn't be further from the truth.

With the new DuckDuckGo browser extension or mobile app, you are now able to seamlessly:

Expose and Block Tracker Networks Watching You

The vast majority of websites across the Internet contain hidden tracker networks, with Google trackers now lurking behind 76% of pages, Facebook’s trackers on 24% of pages, and countless others soaking up your personal information to follow you with ads around the Web, or worse. Our Privacy Protection will block all the hidden trackers we can find, exposing the major advertising networks tracking you over time, so that you can track who's trying to track you.

Increase Encryption Protection

While not all sites offer an encrypted version, thankfully this has been rapidly changing. If we discover a site offers an encrypted version but does not send you to it automatically, DuckDuckGo will. This encryption protects you from eavesdroppers, like ISPs, grabbing up your personal information as it travels across the Internet between you and the websites you visit.

Decode a Website’s Privacy Policy

Most privacy policies are difficult to understand, and aren’t reviewed closely enough. Even if we block all the tracker networks we find, and even if we upgrade encryption, a website could still be using your data for nefarious purposes, such as selling it to third parties.

We’ve partnered with Terms of Service Didn't Read (TOSDR) to include their scores of website terms of service and privacy policies, where available. However, because most privacy policies still remain unstudied, we’re working with TOSDR to help them to rate and label as many websites as possible.

Search Privately

Of course, our app and extension also include DuckDuckGo private search! You share your most personal information with your search engine, like your financial, medical, and political questions. What you search for is your own business, which is why DuckDuckGo search doesn’t track you. Ever.

Once you start using the new app and browser extension, you’ll quickly notice something: hardly any website currently gets an "A" on privacy. That’s because hardly any website out there truly prioritizes your privacy.

Because of these widespread poor privacy practices, too many people believe you simply can’t expect privacy on the Internet. We disagree, and have made it our mission to set a new standard of trust online. We want privacy to be the default, not the exception, and this launch is a major step in that direction.

For the last decade, DuckDuckGo has been giving you the ability to search privately, but that privacy was only limited to our search box. Now, when you also use the DuckDuckGo browser extension or mobile app, we will provide you with seamless privacy protection on the websites you visit. Our goal is to expand this privacy protection over time by adding even more privacy features into this single package. While not all privacy protection can be as seamless, the essentials available today and those that we will be adding will go a long way to protecting your privacy online, without compromising your Internet experience.

As more people start taking their privacy back online, the companies who make money off our personal information will be put on more notice and we’ll collectively raise the Internet’s privacy grade, ending the widespread use of invasive tracking. True to the collective nature of this effort, we’re also building our extension and app in the open with all of the code available on GitHub, so we invite you to join us.

Install DuckDuckGo on any device to take back your privacy!

For more privacy advice, follow us on Twitter & get our privacy crash course.

Update: DuckDuckGo's private search feature in Brave's Private Tab is now available to mobile as well as desktop users.

As we've highlighted before, Private Browsing mode, which is widely available in web browsers, is actually not as private as people think. Although it removes traces of web browsing sessions from your device, it doesn't remove all traces online — websites can still track you and monitor your behavior to build up personal profiles.

Not only that, searches in Private Browsing mode are usually performed using the default search engine. This means a non-private search engine will continue to use tracking methods such as collecting your IP address or browser fingerprinting, which is sadly ironic given that our research has shown that "embarrassing searches" is the top reason for people to choose Private Browsing mode!

DuckDuckGo and Brave Partner on Private Browsing Mode.

To fix this, we've worked with Brave to offer the ability to easily enable private search within their private tabs. In the Brave desktop or mobile browser, when you open a private tab you'll be presented with an option to select DuckDuckGo as your default private search engine. The result is that your searches and personal information will not be collected or shared while using private tabs, in addition to the privacy protection features that Brave gives you by default.

This is a significant step towards giving users more control of their personal information and one we hope other browsers will adopt soon. In Private Browsing mode people expect private searches. With this integration, that's made simple.

For more privacy advice, follow us on Twitter & get our privacy crash course.

As we start 2018, we're proud to look back on a banner year for DuckDuckGo: 55% growth in daily private searches, $400,000 in donations to privacy organizations, new major partnerships with Samsung and Brave, and a lot of privacy education, all in service of our vision to raise the standard of trust online.

In 2017, people all over the world were greeted with nearly daily reminders in the news and elsewhere that their personal information isn't safe online. As a result, privacy continued its growing relevance among mainstream audiences and people came to DuckDuckGo in search of (pun intended!) peace of mind. Here, they found an improved search engine that kept people coming back, with a continued focus on relevancy, especially in local and news results.

These were just some of the driving factors behind our best year to date with nearly six billion private searches. That's up about 50% from four billion in 2016. 36% of all searches ever entered on DuckDuckGo in our ten-year lifespan were conducted in 2017 alone. We started last year averaging about 12 million private searches daily, and ended the year at about 19 million, an increase of about 55%, averaging over 15 million daily private searches for the year.

All this growth enabled us to support more privacy initiatives than ever before, with donations totaling $400,000 to privacy-advocacy organizations including Freedom of the Press Foundation, World Privacy Forum, Open Whisper Systems, Privacy Rights Clearinghouse, Tor Project, and the Electronic Frontier Foundation (EFF). 2017 was our seventh year of making privacy donations, and we're already gearing up for a bigger 2018.

In 2017, we also reached two major partnerships with Samsung and Brave. DuckDuckGo is now a built-in search option within Samsung's Internet browser across all their devices, and also available as an opt-in search engine within Brave private tabs. Most people over-estimate the amount of protection private browsing provides. This Brave integration helps address a top misconception that private browsing mode automatically makes all searches private. It doesn't — you need DuckDuckGo for that!

Finally, we spent a lot of effort last year on privacy education:

• We launched this blog and put out Device Privacy Tips Guides;
• We launched a newsletter explaining privacy concepts (full content here);
• We expanded our social media efforts to bring you daily privacy tips on the major platforms.

So what lies ahead in 2018? You can of course expect more of the same: better search, more privacy donations, more partnerships, more privacy education.

In addition, and in line with our vision of raising the standard of trust online, we have some exciting updates in store for 2018 that will help you protect your privacy beyond search. We can’t wait to share them with you, so stay tuned for announcements. In the meantime, we'd like to thank you all for your continued support and feedback, and wish you a very Happy New Year!

For more privacy advice, follow us on Twitter & get our privacy crash course.

A few months ago, we published research showing significant privacy actions are now mainstream. We've now done some follow-up research to further define this group of people who currently care deeply enough about their online privacy to take significant actions to try to protect it. We found that among U.S. adults, this group now makes up 24% of the population.

This number is based on a new survey we commissioned among 2,025 U.S. adults during October 2017, using SurveyMonkey's Audience platform where the demographic make-up of respondents was controlled to reflect the U.S. adult population.

To qualify as part of this group, respondents had to both express deep concern for their online privacy, and have taken at least one significant action to protect it. Specifically, to gauge deep concern, survey takers had to say that privacy was "Extremely important" in their "next device purchase," and that one of the top two motivating factors to consider switching their search engine is "if it didn't collect any personal data about me or my searches."

For significant privacy actions, respondents had to either "install browser extensions to block web trackers" or enabled the "Do Not Track" setting in their browser.

Nearly one quarter of the population is by no means a small number and this group is certainly not "niche." Privacy is both mainstream and growing. With increasingly invasive advertising, devastating data breaches, and ramping up regulatory focus, we expect this segment to continue to grow. We find that as the population becomes more educated about online privacy, more and more people join this group that both cares deeply about and significantly acts on their online privacy concerns.

For more privacy advice, follow us on Twitter & get our privacy crash course.