Josh Hendrickson
Verizon—yes that Verizon— announced a new “Private” Search Engine, called OneSearch, that promises not to track you. If you find that hard to believe considering who is making the promise, we don’t blame you. And after looking through the OneSearch’s Privacy Policy, one thing seems clear: you should use DuckDuckGo instead.
Most Search Engines Know Who and Where You Are
While browser tracking might be in the news and finally making some traction in the name of privacy, search engine tracking is a whole different beast.
Every time you enter a search term into most of the common search engines (probably Google, maybe Bing), you’re sending three things to the company: your IP address, your User Agent String (identifying your browser), and your search request. That’s enough information to identify who and where you are, and then over time what you like and dislike. Companies build whole portfolios about you based on your search habits alone.
Verizon, the company that tracks your every move through your cell phone, says it wants to change all that, and you should have more privacy. Yeah, we’ll pause to let that irony sink in for a bit. Now technically speaking, this is a different wing of Verizon company than the cell phone provider, but it still strikes as an odd proposal. So we examined the OneSearch Privacy Policy and found a few concerns.
We Promise to Forget the Things We Learned
The first thing you should know about OneSearch is that Verizon didn’t build a completely new Search Engine. Instead, all of its search results are coming from Bing. That’s probably not comforting to know, but it’s how OneSearch handles your search information that matters. While OneSearch’s privacy policy is (refreshingly) written in plain English, you have to scroll to section three (titled What We Collect, How We Use It and Why We Do This) to find out what data the service collects.
And let’s be clear, the service does collect data. But as spelled out in points 3.5 through 3.7, OneSearch promises to forget what it learned about you. The company sees and stores your IP address, User-Agent, and Search Query, and initially, it keeps all of that information together—just like Google and Bing.
But then it separates the info to different servers to dissociate who you are with what you searched. Eventually, OneSearch says it will delete your IP address entirely—but Bing won’t. It’s right there in point 3.7:
The Search Provider continues to store your IP Address, Search Query and UA for the purpose of Network Traffic Protection. After four days the Search Provider Obfuscates the IP Address
So Bing (referred to as “The Search Provider” above) will keep your information and keep it all together. But eventually, it will obfuscate (not delete) your IP Address. Network Traffic Protection is essentially the process of knowing where to send your search results so you can see them. It’s unclear why OneSearch or Bing would need to hold onto that information after you’ve finished searching.
OneSearch says it won’t target ads based on your search history, just your current search term. And the promise to forget who you are should ensure that. But it’s not promising to delete your search terms or your user-agent data. That’s obvious because despite “not tracking search history,” the search engine offers “trending searches.”
All-in-all, that’s an overly complicated way of not learning about you. It seems like it’d be easier to not learn about you in the first place—which is where DuckDuckGo comes into play.
DuckDuckGo Has a Stupidly Simple Privacy Policy
DuckDuckGo has been around for ages and has long promised to provide a private search engine that won’t track you. The service’s privacy policy is a masterclass in how to comfort people. First, it starts with the following words:
DuckDuckGo does not collect or share personal information. That is our privacy policy in a nutshell.
You can almost tell the people behind DuckDuckGo wanted to call it a day, but the lawyers insisted they say more. DuckDuckGo’s privacy policy is incredibly detailed but broken into easy-to-understand sections with jump links. Here’s the part the matters:
When you search at DuckDuckGo, we don’t know who you are and there is no way to tie your searches together.
When you access DuckDuckGo (or any Web site), your Web browser automatically sends information about your computer, e.g. your User agent and IP address.
Because this information could be used to link you to your searches, we do not log (store) it at all. This is a very unusual practice, but we feel it is an important step to protect your privacy.
That’s a clear, distinct difference between OneSearch’s policy and DuckDuckGo’s policy. OneSearch promises to learn about you and then forget about you. It will store your information for a while, and then take some steps to make that fact sound better. DuckDuckGo just never learns about you. It never stores your info.
Here’s another sentence from DuckDuckGo’s policy that makes a huge difference: “At DuckDuckGo, no cookies are used by default.” What’s OneSearch’s policy on using cookies? It doesn’t say.
As an additional measure of transparency, DuckDuckGo includes a changelog history for its privacy policy. You can see what changed, when, and why it changed. And best of all, DuckDuckGo doesn’t use another search engine to power its results, so your information isn’t handed out either.
Just Use DuckDuckGo
We want to applaud what OneSearch and Verizon are attempting to do here. But the methods are a bad implementation at best. Given that this comes from a company that makes a great deal of money from tracking people, it has a lot to prove to gain our trust. And so far, the privacy policy and promises to forget aren’t comforting.
If you want to use a search engine that won’t monetize your life history the choice is clear, just use DuckDuckGo.
