After Pushback, DuckDuckGo's Browser Will Block Microsoft Trackers

The third-party tracking scripts DuckDuckGo blocks from loading on websites will now include scripts from Microsoft in its browsing apps and browser extensions.

UPDATE: DuckDuckGo now says it will crack down on Microsoft trackers.

The company says it will "expand the third-party tracking scripts we block from loading on websites to include scripts from Microsoft in our browsing apps (iOS and Android) and our browser extensions (Chrome, Firefox, Safari, Edge and Opera), with beta apps to follow in the coming month."

An exception is the bat.bing.com domain, a tool within Microsoft Advertising that lets advertisers see if people's clicks turned into purchases.

"Currently, if an advertiser wants to detect conversions for their own ads that are shown on DuckDuckGo, 3rd-Party Tracker Loading Protection will not block bat.bing.com requests from loading on the advertiser’s website following DuckDuckGo ad clicks, but these requests are blocked in all other contexts. For anyone who wants to avoid this, it's possible to disable ads in DuckDuckGo search settings," DuckDuckGo says.

Original Story 5/25:

DuckDuckGo's browser for iOS, Android, and macOS reportedly allows Microsoft trackers to operate despite claiming that it "automatically blocks hidden third-party trackers" for its users.

This exception to DuckDuckGo's tracker protections was revealed by security researcher Zach Edwards on May 23, BleepingComputer reports. Edwards tweeted evidence of DuckDuckGo's browser allowing trackers used by LinkedIn and Bing to load on the website for Workplace:

DuckDuckGo CEO Gabriel Weinberg said on May 23 that "our Microsoft search syndication agreement prevents us from doing more to Microsoft-owned properties" and that his company has "been continually pushing and expect to be doing more soon."

But it's still unclear how exactly DuckDuckGo handles Microsoft's trackers. Weinberg says:

Weinberg offered additional clarification in a post on the Hacker News forum:

"This is just about non-DuckDuckGo and non-Microsoft sites in our browsers, where our search syndication agreement currently prevents us from stopping Microsoft-owned scripts from loading, though we can still apply our browser's protections post-load (like 3rd party cookie blocking and others mentioned above, and do). We've also been tirelessly working behind the scenes to change this limited restriction. I also understand this is confusing because it is a search syndication contract that is preventing us from doing a non-search thing. That's because our product is a bundle of multiple privacy protections, and this is a distribution requirement imposed on us as part of the search syndication agreement. Our syndication agreement also has broad confidentially provisions and the requirement documents themselves are explicitly marked confidential."

DuckDuckGo has also updated the description of its browser in the App Store to read: "Note About our Tracker Blocking: While we block all cross-site (3rd party) cookies on other sites you visit, we cannot block all hidden tracking scripts on non-DuckDuckGo sites for a variety of reasons including: new scripts pop up all the time making them difficult to find, blocking some scripts creates breakage making parts or all of the page unusable, some we are prevented from blocking due to contractual restrictions with Microsoft."

In a statement, a DuckDuckGo spokesperson told us: "We are doing a lot to block [Microsoft] tracking, including blocking third-party cookies. It is not true to say we're not blocking anything from [Microsoft] at all. Only one part of multiple privacy protections we offer is impacted by the agreement." It also stressed that the deal with Microsoft "has no bearing on our search results."

The spokesperson says too that "folks who use the DuckDuckGo browser on mobile or macOS (in beta) are still getting significantly more privacy protection by default with DuckDuckGo than they would using Safari, Firefox, Chrome and other browsers" and that DuckDuckGo has "never promised 100% protection because it's not possible for a number of reasons."

Source