DuckDuckGo

Is DuckDuckGo safe?

For privacy, yes, and by a wide margin over mainstream browsers and search engines. DuckDuckGo says it does not save your IP address or any ID with your searches, its app blocks most third-party trackers by default, and Apple's privacy label lists nothing linked to you. We score it 85/100.

The limits are its business model and the open web. DuckDuckGo earns money from search ads delivered through Microsoft, and that partnership produced an embarrassing tracking exception in 2022 that still has a small remnant today. And a privacy browser is still a browser: phishing pages, fake shops and adult content are a tap away.

What does DuckDuckGo collect?

Very little that points to you. The privacy policy, updated in 2026, says DuckDuckGo does not save IP addresses or other unique identifiers with searches, Duck.ai chats or website visits, and that "it's not possible for us to provide search, chat, or browsing histories linked to you" to authorities. Search ads are chosen from the words on the results page, not a profile. For Duck.ai, separate terms say recent chats stay on your device and model providers must delete prompts within 30 days.

Apple's label backs this up. It lists usage data and diagnostics for analytics, and an email address for the optional Email Protection forwarding service, all marked as not linked to your identity. Compare that with Gmail, whose label shows location and identifiers used for third-party advertising.

What was the Microsoft tracker controversy?

In May 2022 security researcher Zach Edwards found that DuckDuckGo's mobile browser blocked Google and Facebook trackers on other websites but let some Microsoft ones, from Bing and LinkedIn, load. Chief executive Gabriel Weinberg said the company's search syndication agreement with Microsoft prevented it from doing more, and the restriction had been mentioned only in the app's store description. After a backlash, DuckDuckGo said in August 2022 that it would block Microsoft's tracking scripts too.

One exception remains, and DuckDuckGo now documents it. When you click a DuckDuckGo search ad, requests to Microsoft's bat.bing.com can load on that advertiser's own site so the advertiser can count the sale. Cookies set this way expire after seven days, and the requests are blocked everywhere else. You can avoid it entirely by turning off ads in DuckDuckGo's search settings.

How secure is the browser?

The iOS and Android apps are public on GitHub, the company runs a vulnerability disclosure program on HackerOne, and we found no data breach. The browser upgrades connections to HTTPS where it can. Its optional Sync & Backup encrypts data with a key that stays on your own devices.

DuckDuckGo builds on Apple's WebKit and Android's system web engine rather than its own, so many security fixes arrive through operating system and WebView updates. Keep both up to date.

Scams and adult content

The App Store rates DuckDuckGo 16+ because it gives unrestricted web access. Safe Search filters explicit results, but nothing stops a teenager from typing an address. A built-in Scam Blocker uses Netcraft's threat list stored on the device. In June 2025 it was expanded to warn about fake online shops, fraudulent crypto exchanges and scareware pop-ups, without using Google's Safe Browsing service, which Chrome and Safari rely on. It only catches known sites, so new scam pages slip through for a while.

How to get the most from DuckDuckGo

1. Turn off search ads in settings if you want no Microsoft ad-click tracking at all.
2. Use the Fire Button when you finish a sensitive session, and mark the sites you want to stay signed in to as fireproof so they survive the wipe.
3. On Android, App Tracking Protection can block trackers inside other apps, not just in the browser.
4. Do not treat a private browser as anonymity. Your internet provider still sees the sites you visit unless you also use a VPN or Tor.
5. For children, rely on Screen Time or Google Family Link rather than the browser.

How we scored it

DuckDuckGo is strongest on privacy (90) and regulatory record (95), with no fines found. Its weakest factor is scams and harmful content (72), because a browser exposes you to the open web. It scores level with Proton Mail (85): both protect what they hold well, and both depend on partners or channels they do not control.