Search Engines

One of the most common online services that we use on a day-to-day basis is the search engine. However, search engines represent a unique type of privacy threat. Every search engine in existence has at least a few privacy issues, and we tend to put sensitive information into the search boxes.

Video Lecture

Search Engine Threats

Due to a combination of the evolution of the Internet and some clever marketing, the word “Google” has become a common verb in the English language (and perhaps some others also). Need an answer to a question? Just Google it. Want to find a place to eat? Google it.

Professor Douglas Schmidt of Vanderbilt University describes Google this way:

“Google is the world’s largest digital advertising company. It also provides the #1 web browser, the #1 mobile platform, and the #1 search engine worldwide. Google’s video platform, email service, and map applications have over 1 billion monthly active users each. Google utilizes the tremendous reach of its products to collect detailed information about people’s online and real-world behaviors, which it then uses to target them with paid advertising.”¹

Whenever a user makes a Google search query while logged into the service, Google collects and saves that search activity, tying it to the user along with location data provided by the user’s browser or device. Even if the user is not logged into Google at the time of the search, the search engine is instrumented to collect considerable data about the user.²

Microsoft isn’t doing any better in this arena. After a data breach involving their Bing search engine, researches discovered that Bing logs search terms, location coordinates to within a half kilometer, the exact time of the search, URLs the user visited from the search results, and information about the user’s device and operating system (among other data). If the user is signed into Bing at the time of the search, there also appears to be an association of the search terms with the user’s account.³

Alternative Search Engines

Ultimately, choosing a search engine requires trusting some third party or entity with search queries. Two sites have historically marketed themselves as “private” search engines: DuckDuckGo and StartPage. While these search engines are still worth considering and are listed below, they are far from perfect. DuckDuckGo was caught allowing Microsoft to track their mobile app users.⁴ While this issue didn’t affect their search engine, the company wasn’t upfront about the problem and only renegotiated their contract with Microsoft after this fact was discovered by a third party.⁵ In another case of a search engine becoming owned by an advertising technology company, StartPage was acquired by Privacy One Group, which is a subsidiary of advertising technology company System1.⁶

The trouble with third-party search engines is that the success of a search engine depends on the breadth and depth of its search index. This search index is the database of content from which the search engine can return results to a query. If the index is too small, the quality and number of results will be lacking. Since crawling websites to build and maintain a search index is extremely expensive, it isn’t surprising that two of the wealthiest companies – Google and Microsoft – control the largest indexes.⁷ Most other search engines wind up purchasing results from Google or Bing data in an arrangement known as search syndication.

“Private” Search Engines

If we stop to consider some of the alternatives to Google and Bing, DuckDuckGo and StartPage are still viable in spite of their issues. In the case of DuckDuckGo,⁸ their privacy policy claims that IP addresses are not logged, and that search queries cannot be tied back to uses (although they are logged).⁹ DuckDuckGo primarily syndicates its results from Bing. StartPage,¹⁰ on the other hand, syndicates its results from Google. Despite its ad tech ownership, the StartPage privacy policy claims not to record IP addresses, not to use tracking cookies, and not to store search queries in a way that can identify users.¹¹

MetaGer¹² is another option for a search engine that syndicates results from a variety of other search engines. Their privacy policy claims to log IP addresses for up to 96 hours and that the search query is not considered “personal data.”¹³ Given the sensitivity of many of the queries users tend to make, claiming the query is not “personal” does not exactly inspire confidence.

Yet another third-party search engine is Ecosia.¹⁴ Based on a review of its privacy policy, this search provider may log IP addresses for up to 7 days, and search queries can be associated with the IP address for that long as well.¹⁵ This provider syndicates results from Bing, positioning it as a possible competitor to DuckDuckGo.

Two third-party search engines maintain their own search indexes. Brave Search¹⁶ provides results from its own index but supplements these results from Google syndication where needed. According to its privacy policy, Brave Search claims not to collect personal information about users, devices, or queries, and IP address logs are only retained for a few seconds to deter abusive bots.¹⁷ Mojeek¹⁸ serves results from its own index and claims not to log IP addresses or track users, but it does log country codes, timestamps, URL information, and browser data.¹⁹ It is unclear whether or not Mojeek logs search queries.

All the above analysis of search engine privacy policies is all well and good, but ultimately, no meaningful conclusions can be drawn about any of the alternative search engines. Since it is hard to obtain independent confirmation that a company is following its own privacy policies, it is best to consider all search engines to have questionable privacy at best. Cases of companies claiming not to track users and then found to support tracking have been observed in practice, as noted with DuckDuckGo above.

Consider also the wealth of personal information that users routinely give to search engines. If one could observe a person’s search queries over time, it would be possible to build a comprehensive profile of them as a consequence. Humorous depictions of this observation have been made.²⁰

Alternatives for Improving Privacy

Instead of using a corporate search engine, one alternative would be to use an open-source metasearch engine like Searx.²¹ With this approach, searches are sent to an automated software platform that queries a variety of backend search engines to obtain results. While Searx can be self-hosted and run on a user’s computer, all the backend search engines would see the user’s IP address and could associate that address with the search queries. Community instances of Searx are available online, but then the trust model is simply shifted from a corporation to an individual, volunteer group, or perhaps even an unknown entity.

Since there is ultimately no way to guarantee that the search provider is trustworthy in terms of user privacy, it is probably a better approach to treat search providers as privacy adversaries. However, the use of search providers is an indispensable part of modern life. Therefore, private use of any search engine will require some way of hiding the user’s identity from the search provider. Use of a Virtual Private Network (VPN) connection or The Onion Router (Tor) when performing searches could help to improve privacy.

References and Further Reading

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.