🔒 In Conversation With: Gabriel Weinberg & Matthew Prince

Gabe, so great to see you. Welcome, welcome to Cloudflare TV. Thanks for tuning in as part of Cloudflare's Privacy and Compliance Week. We've known each other for a while. We shared an investor that was there, and I've really admired always the clarity with which you've talked about privacy, and we'll talk a bunch about that. But I realized as I was starting to think about this, that I don't really know the backstory of DuckDuckGo. How did you guys get started? What was the idea that you'd build a search engine? How did this project get started? Sure. Thanks for having me on. Interestingly enough, I was just listening to the backstory of Cloudflare on a podcast before this. So that was interesting to hear. But I'm sure most people that's already know that. For DuckDuckGo, it really started just myself. I was really interested in following the footsteps of Mozilla with Firefox. And so if you think about them, there was a monopoly provider in browsers, Microsoft Explorer, and they wanted to make a browser that was more oriented toward the user. And so I saw the same thing in search, and Google had become a monopoly provider in search, and in my opinion at least, wasn't doing things that were best for the user. And the original thesis was like, let's create a search engine that is that, just good for the user. Privacy was definitely one of those main things, but there were others that I thought Google wasn't doing the greatest job for the user. Spam was one, instant answers was another, design sclerosis was another. And then set out to build that. I really did it myself for the first four or five years, just literally plugging away, doing everything myself until early adopters really started switching to the search engine. At that point, over that period of time, Google reacted to a worse and worse on privacy. So the vector of interest where we can make an impact was privacy. And at that point, I took a step back and said, I'm one person, I'm capitally starving this business, and it could be a much bigger impact if I go make a team and company about this, and then went on the path from there. But that's really the origin story. So in those days when you were on your own, starting a search engine seems like an incredibly daunting task. How do you actually go about doing that? It sounds super hard, is it as hard as it sounds? I don't know. I think I have a weird, kind of eclectic background. So before that, I had run another company and I was the only employee from beginning to end. And I think from that experience, had learned enough of all functions of a company to be like, oh, enough to be dangerous, I guess, and be willing to start something. For search in particular, it's like the confluence of all sorts of things I had some knowledge in and was interested in, like crawling websites and databases and kind of information retrieval algorithms and stuff like that. Just all things I've been personally interested for a long time. I started out doing what people think about, thinking back to the mid-2000s as search, which is like crawling everything and indexing and putting it on the page. But I did that for a while, but quickly realized that actually was not the future of search. And that part of it, similar to browsers again, had reached diminishing returns in a way, like the rendering of web pages were similar from browser to browser. Actually, if you went different search engines, the top 10 links were actually very similar in most of these search engines. But what I thought you could differentiate on was better instant answers, less spam in the results, better privacy, other things that are added value on top of what I was almost seeing as a commodity in the results, in the index results. So I eventually kind of pivoted and said, I'm going to try to get those from somewhere else and then add value on top of all that and do more interesting things that hadn't been done before. So what was your background before? What was the company you started and what were some of the things that were the kind of confluence of events that allowed you to have the confidence to do this? I went to MIT. I was a physics undergrad and really started a company right out of school, educational software company, and kind of hired people, my friends who were in computer science and other things, but I took it up on myself to do their jobs too so I could learn those aspects, including system administration and some of the stuff that Cloudflare started off doing. And then the second company, that ended up going absolutely nowhere. So it was a great idea, but 20 years too early, we could talk about things like that. The second company was really an early kind of private social network. So if I had stuck with it, maybe it would be a good alternative right now with the Facebook case coming out. But what happened was it basically got eaten by Facebook early on. Some of the things that you kind of did there was like, there was no advertising on the site, you know, it was more of a subscription service. It was really competing with classmates.com type of thing at the time, which is now anachronistic. This was 2003, 2006. This was a long time ago because I started DuckDuckGo in 2007. But from doing that, I learned a lot about, you know, running a site with a lot of people and traffic coming through it and, you know, working with email protocols and things like that. And, you know, scraping the web and stuff like that. Maybe a silly question, but where'd the name come from? I mean, I assume it's a play on DuckDuckGoose, but what was the rationale? Yeah, not even really explicitly. It just kind of popped into my head one day. I mean, previous companies, like my company out of school was about increasing parental involvement. So it was like this educational software company, his name was Learn Action, and it was like the worst name. So no one could pronounce it, no one could spell it. And I just wanted, whatever I did next, I wanted a name that was memorable and kind of fun. And so I did, I thought of the name before the company and was like, whatever I'm going to do, I'm going to use that name. And I don't have a great story. It just popped in my head. You said that Google, you know, pretty early on, even before when you were just on your own, started to respond to you. That must have been, I mean, a giant, you know, $100 billion plus company comes after you sort of when you've got this project. What was that like? And I remember the fight over Duck .com, which I think you have. Yeah, we were tiny at the time. That was still just me. That was in 2010. Yeah. And they have a history, it wasn't just us, like they were extremely paranoid to competition, which is somewhat coming out now in the antitrust case. But like there were a lot of instances of them kind of paying very close attention to tiny startups that could gain any amount of traction and trying to kind of squash them in any way possible. It seemed irrational to me, like we were tiny. But I kind of see it. I mean, what we're doing in terms of privacy, I think is a real threat to their business model in general. And so I can see their attitude of wanting to just squash it. But it's just, it's made me just want to do it more. I mean, really, it's just to be like, this is really where an impact can be. So your business model is still, it still is advertising based. I mean, you display ads and you make, I think, most of your revenue that way. How have you done that in a privacy preserving way? Whereas a Google, what is the difference between, because at some level, if you just sort of dropped into these pages, you were an alien from outer space and you did a search on Google and you did a search on DuckDuckGo, kind of the experience for the ads seems somewhat similar, but behind the scenes, it seems like you're doing some things that are more in a user's favor. Oh yeah, absolutely. So we kind of run private advertising, but taking a step back, let me get to your question. We started out this search engine, ran it for a decade privately, but then we've really branched out. And at the moment, our pitch to a consumer is really, I would call it the easy button for privacy. So if you could, we're not there yet, so this is a long -term story, but for all the people who kind of want privacy on the Internet, but feel kind of powerless to get it, that's the call that we're answering. And if you could just kind of press the button and magically be private online and everywhere you use the Internet, so search and browsing, but also email and apps and payments, that would be our ideal solution. And we call it Privacy Simplified. And our current products, we- I've heard you start to describe, when we first met you described DuckDuckGo as a search engine, and now you describe it as a privacy company. So it does seem like there's been an evolution there. Yeah, exactly. And that's a brand education evolution, because we've been growing exponentially, like most of the people who know us are from the last two years. And so they've seen us more as the privacy company and maybe adopted our app, which is like a full browsing app with all these features. But we have all these people who knew us from 10 years ago who are like, you're a search engine. And so I'm working on that kind of brand re-education. But from that perspective, yeah, we offer this kind of all-in-one privacy solution. And right now it's really search and browse together with search engine, tracker blocking, and encryption. And on mobile, it's a full browser. On desktop, it's a browser extension. And we hope to add more to that over time. But to your business model question, yeah, we make most of our money via private search ads. And so what I mean by that is, this is actually the way Google started out making money before they started tracking you all over the Internet, which is when you type in car or mortgage or whatever you want to buy, you get an ad based on that keyword, not based on you as a person. So we call that contextual advertising because it's based on the context of the page versus behavioral advertising, which is the stuff that follows you around and is creepy and whatnot. And we just do that first time. It's like the old Internet before it got creepy. We do contextual advertising all the time. Whereas Google has not only kind of layered on behavioral advertising onto Google search, but they actually use your search query to power ads in all their other properties like YouTube and Gmail. But also what people don't realize about Google is they run ads for most of the Internet, which is they're on millions of websites and apps. And those ads that are following you around are generally keyed all the way back to your Google searches. And so when you just do contextual advertising, though, it just kind of stays siloed into your engine. And then we layer privacy on top of that. We don't have any user sessions or user history of search histories at all. But that's really the difference. So let me see if I explain this and if this is right. So when somebody searches for something, let's say you search for blue Chevy Aerostar van on DuckDuckGo, then you go out to your advertisers and you say, hey, someone, I don't know who they are, but somebody is searching for a blue Chevy Aerostar van. Maybe do you have some data on where I'm located? So you can go to a dealer that's in wherever I am around the world. But there's something about that. It's not Matthew was searching for. It's just someone out there located in this part of the world is searching for that. And then does anybody want to show an ad in that? And then you show the ad. And if I click on it, then I might go buy a Chevy Aerostar van or not. And the merchant's able to get that. But you don't then make it so that when I go to the New York Times or when I go to whatever else, the blue Chevy Aerostar van isn't following me around the rest of the Internet. Is that roughly right? That is exactly right. And then the only thing I add to that is if you have our kind of technology, the browser or the extension, when you click on either that site or another site, just the results, like not necessarily the ad, but going to a site about the Chevy van, like we are blocking Google and Facebook and all the other companies, trackers on that site. So they can't even use your browsing history to do that same ad targeting across the Internet, because a lot of third parties are just lurking on websites, not even just on the search engine or just behind the scenes, just trying to figure out that you even landed on a page about the Chevy van. So a question I've always wondered, because Google, when they launched, was actually kind of similar to the way that you're doing. And again, as you said, they've added the behavioral advertising on top. Do you have any sense of if Google tomorrow just said, we're going to get rid of all the behavioral advertising, we're going to go back to just purely contextual? We'll target the ads on pages based on what the content on the pages is. We'll target you with search ads based on what you're searching for. How much of a revenue hit would that be for them? Yeah. I mean, so last year I wrote a New York Times op-ed with this exact premise. And I believe that both Facebook and Google could turn to completely contextual advertising and still be among the most profitable companies in the world. I think it's about putting kind of, there's kind of two reasons why I think you're doing. I think there's one of just like the capitalist story of, you know, putting profit before people and kind of squeezing out every last amount of profit. So not just being one of the most profitable companies in the world, being like the most profitable company in the world. And they've kind of crossed that line. And the other strategic reason. So this gets a little more nuanced. So feel free to take me on a different line of questioning. But like, you know, Google and Facebook are in advertising, digital advertising duopoly, right? Most people go to them. Not necessarily at all, because behavioral advertising is more, is better or anything for the advertiser. In fact, there's a lot of studies now that show that it may not be that contextual advertising may be just as good, but they have amassed most of the audience. And they're really only offering behavioral advertising. And what that's done is made them the only places to get behavioral advertising because they're, they're the only ones with the audience and kind of developing that technology. And what that means is the contextual advertising market, it has been starved of dollars and innovation and venture capital and everything for the last 10 years. And so one hope that we have, kind of like the regulation perspective that we've been advocating for, is a real key to some kind of do not track setting, a modern one, we proposed one recently called the global privacy control. And that if everyone, consumers, they can opt in to a setting in their browser that says, I don't want to be tracked by Google and Facebook across the Internet. All of a sudden, say like 30 % of people opted into that. It's a huge market for contextual advertising. And then maybe we could grow that market again. You know, one of the things that I, that I, that I worry about is, you know, a lot, a lot of our customers are publishers. Some of those publishers, you know, generate revenue from the advertising, which is on their, on their pages. And, and, and advertising at some level is like the one micro payment that works at scale where, you know, someone targeting me with an ad that the rate that they get for that is much more than the rate that they get from some, you know, kid who's, who's a computer genius based in Bangladesh and just trying to learn about whatever the, you know, latest programming is. And yet you make enough from the kid in Bangladesh, you make something. So it makes sense to open content up and, and democratize it. I think as, as, as this sort of advertising space has gotten more and more and more squeezed, you're seeing more content end up behind paywalls. And again, that's fine for you. It's fine for me. We can, we can afford to pay for it. But that kid in Bangladesh, like, I feel like they're all of a sudden at a, at a huge disadvantage. How is, are you guys, I mean, I know Brave has sort of thought about some of how to do that. And I, and I think with, with moderate success, but as you shut down some of the ability for publishers to earn as much from the ads that are on, on their pages, given the ecosystem today, what, what, what fills that in the future or, or, or is all content going to end up behind subscriptions and paywalls? Like you've thought a lot about this and I'd be curious to, to hear what you think. Yeah. I don't, I don't think it has to, and DuckDuckGo is not anti-advertising to your point. We make most of our money via ads, just private ads. Right. And we also make a big distinction like between our, our privacy solution is not an ad blocker. It is a tracker blocker. It blocks unnecessary tracking, but if you're doing good private advertising, like contextual advertising, we have no interest in blocking that and would like to even support it. And some of these efforts, like I was referring to the GPC, I think that we can get these going from either our own kind of industry perspective, which we're trying to do, or getting help from regulators. We could breathe life into this contextual advertising market. And to put a point on that a bit, the difference between kind of the, how that could work in practice, right. Is right now, for example, you know, sites, the biggest tracker on the Internet is Google analytics. So it's Google's analytics service. It's free. 75% of like top million websites have it lurking on the site and they use it and they're trying to use it for themselves to like make their either advertising better or their marketing better or their site better. But in reality, it's also slurping off the browsing history and adding right to the behavioral profile for, for, for Google. Now we block that tracker. Interestingly, most major browsers do not block that tracker. You could ask why, but they don't. And so you need something like that to go to block it, but it doesn't need to be that way. Right. So you can have an analytics piece of software. And I just first party, you know, like it doesn't it's for the site. You can get the same results, but you don't need to also add to this behavioral profiling ecosystem. And so I think that's the future is like services that come up that help publishers that stay within their kind of first party data silo. Yeah. I mean, it's, it's amazing. I remember that, you know, I, that we, we installed Google analytics on, you know, a bunch of projects and other things because we, because, because we were trying to before Cloudflare, because we were trying to just understand like, who's going to the site and are they using it? And it was, it was a simple, easy way of doing it. And I, and I looked back at, at some of those, those things, and they're still Google analytics tags on all of those, those pages. And so when we, you know, there, there, there is, if you are, if you're building a site that you, that you are doing behavioral advertising to draw, drive traffic to, and those things, then Google analytics is a tool that really is, is done that. But our, our motivation behind launching the Cloudflare analytics solution was to say, listen, if, if all you need is just to know how people are interacting on your site, what let's, let's build something that is very privacy preserving and, and our, you know, a lot of times people ask what's the catch. And the catch is, well, we hope then you'll, you'll discover Cloudflare and then you'll sign up for the services that you pay us for. And so it's, it's really, I mean, it's, it's, this isn't a charity, like we're still doing this as a, as a way to, to, to, to do this in it, but, but the business sense makes sense for kind of the, the, the more private Internet as well. So it's, it's been, that's been, it's, it's been amazing to see how, how much that's, that's really resonated. Do you, is it, you know, one of the things I was really, I used to teach privacy law and, and I, I, I, and we, and the people would sign up for my class were like, you know, I don't use Facebook and I, and I block everything. And, and then, and then I would, I would ask them, well, you know, how many of you, when you went shopping the other night used your, your grocery store discount card? And everyone's like, of course I did. You know, I got 18 cents off grapes and I've always been sort of, I mean, it's, it's been disheartening to see how quickly consumers are willing and for how little they're willing to give up their private information. Do you see something changing in that, in that world or, or, or is there, is there, is there hope that people care more about this going forward or, or is this, again, what I've always worried about is people talk about privacy a lot, but at the end of the day, you know, it doesn't take very much for them to, to give it up. Yeah. I mean, which is termed often the privacy paradox. So I, I think the privacy paradox after saying this for a bunch of years now is somewhat of a myth. And so, and can be unraveled even in the, even in the kind of loyalty case for coupons, if people really understand what's happening with their data. And so like, even in the, like the grocery case people generally don't realize that data is being sold to third parties. They think it's still just being used by the grocery store and they're okay. It, you know, privacy is, is, can be a trade-off in different areas, right? Like if you're getting something for it you know, you might want to make that trade-off in certain cases. And there's, there's crime, you know, trade-offs that people make and things like that. The problem with it is, is no one's really making that trade-off in a lot of these cases because they haven't been educated as to what's really going on. And when you actually kind of pull the curtain back and say, actually, it's not just you getting a coupon here, but your data is getting sold and that's why you're getting all this junk mail and targeting, and it might lead to discrimination against you and not getting certain job ads online and all these other things. People are like, and people have done this study, they're like, whoa, I actually, I don't, I won't take the loyalty card anymore, you know? So I think that unravels the paradox. Now to the, to your kind of underlying question, we measure, because we think our audience is the group of people who not only say they care, but will actually do something about it, right? Will act, we call that the care and act on privacy group. And we've been trying to figure out ways to measure that group. And it has really been growing and it, you know, the two inflection points, this is, you might just guess this, were kind of Snowden back in 2013 and then Cambridge Analytica in 2018. And it wasn't just that those were revealing, it's that the media then spent the next couple of years kind of like educating some of the stuff that was happening behind the scenes. And if we do that too, like part of our brand story, we explain like all this hidden web tracking. That's like the aha moment for people. They're like, yes, I don't want my data sold and things like that. And so we can basically expand that market. I think in the long-term asymptote of that is like the people who care actually do care. They just don't really understand either what to do about it or how it really works or really what they're giving up, you know? And there's a bunch of kind of studies I could recite, but the basic idea is once people understand kind of what's under the kimono, they're like, okay, I will like back off some of this stuff. Does, you know, as, you know, one of the things that you've talked about is sort of the role of regulators. You know, we just saw it the other day, the Facebook lawsuit, which was really focused on competition, but privacy snuck in a lot of that and actually how the sort of lack of competition in that space has let, has kept people from competing on privacy. Any thoughts on sort of the sort of recent regulatory actions coming out of the US against both Google and Facebook? Yeah, definitely. A couple of broad thoughts. I mean, there's one kind of just general school of thought that like, you know, we need regulatory action in this area. And I agree with that, but it doesn't follow that we need that to solve some of our consumer privacy problem today. Like our kind of pitch for our product, and I think part of Cloudflare's pitch and some of its products is, you know, you don't need regulation to solve some of these problems. Like we're offering you a solution today that you if you've kind of fed up with all this stuff, you can do something right now about it. That said, we're still, and I think Cloudflare is too, advocating for good regulation to help clean some of this up even further and make it so that these markets are just like more competitive and kind of better. So with that being said, I think privacy is at the core of both of these suits. Really, for two reasons. One is the consumer harm, and especially this case in the Facebook cases yesterday, articulated is that Facebook has gotten worse and worse in privacy, and that is part of the harm that people don't have any alternatives. And the same is true with the Google case is that while they can use their takeover search, Google's been holding us back. And we think if they weren't kind of tying up all the exclusives, we'd be literally 10 times bigger than we are now. We're proud to be number two in mobile search in the US, but we're about two, 3%. We think we would be like 20% if you could just choose your search engine when you install an Android device or an iPhone. So I think that privacy is really at the center of these conversations, and that if the actions were to kind of go to fruition and have good results from consumer perspective, like you would have all these other kind of private alternatives kind of blossom, us being one of them. So we have about two minutes left. And so this is maybe a question that that's not giving enough time for, but if you had just sort of your regulatory druthers, what would be sort of your advice to regulators as they're thinking about the things that make sense for there to be regulation, and then maybe the things that make sense for people to sort of stay out of and let the competition deal with? Yeah, a brief answer. I mean, I think in search market in particular, you kind of need consumers in control and be able to choose their provider. That's kind of what we're asking for. More broadly, like the central competition issue with Google and Facebook is the same. It's massive data collection and the data monopolies that result from that, and all the harms fall from the data collection. Discrimination, polarization, filter bubbles, it's all the same stuff used for ads is the same stuff for all that stuff. And so you got to do something about data monopolies. There's a lot of things you can do in terms of remedies, but that's the core thing you got to focus on is how to reduce the data monopoly. And so you've branched out from search to doing browsing. What are some of the other things that are kind of on your radar or roadmap or just ideas that are bouncing around in your head and your team's head? If you think of privacy simplified, you're tracked in all sorts of other places. You're tracked in your email, you're tracked in other apps, you're tracked in payments, you're tracked in social media. All of those areas are areas that if we were succeeding to our full vision, we would have some part of our solution to help you with. Yeah. Well, Gabe, I really appreciate you. You're someone that I've admired for a long time, and I admire DuckDuckGo. We're trying to live up to the same privacy principles ourselves at Cloudflare. And so make sure that we do that. And for anyone who's watching, give DuckDuckGo a try. I think you'll be surprised how much it can really replace your everyday search experience and your browsing experience. So appreciate it, Gabe. Thanks for joining us on Cloudflare TV. Thank you. Take care. Bye.