🔒 In Conversation With: Gabriel Weinberg & Matthew Prince

Gabe, so great to see you. Welcome to Cloudflare TV. Thanks for tuning in as part of Cloudflare's Privacy and Compliance Week.

We've known each other for a while.

We shared an investor that was there, and I've really admired always the clarity with which you've talked about privacy, and we'll talk a bunch about that.

But I realized as I was starting to think about this that I don't really know the backstory of DuckDuckGo.

How did you guys get started? What was the idea that you'd build a search engine, or how did this project get started?

Sure. Thanks for having me on.

Interesting enough, I was just listening to the backstory of Cloudflare on a podcast before this, so that was interesting to hear.

But I'm sure most people listening to this already know that.

For DuckDuckGo, it really started just myself.

I was really interested in following the footsteps of Mozilla with Firefox.

If you think about them, there was a monopoly provider in browsers, Microsoft Explorer, and they wanted to make a browser that was more oriented toward the user.

I saw the same thing in search. Google had become a monopoly provider in search, and in my opinion, at least, wasn't doing things that were best for the user.

The original thesis was, let's create a search engine that is that, just good for the user.

Privacy was definitely one of those main things, but there were others that I thought Google wasn't doing the greatest job for the user.

Spam was one, instant answers was another, design, sclerosis was another. Then I set out to build that.

I really did it myself for the first four or five years, just literally plugging away, doing everything myself, until early adopters really started switching to the search engine.

At that point, over that period of time, Google reacted to a bunch of things I did, but got worse and worse on privacy.

The vector of interest where we can make an impact was privacy.

At that point, I took a step back and said, I'm one person, I'm capitally starving this business, and it could be a much bigger impact if I go make a team and company about this, and then went on that path from there.

That's really the origin story. In those days when you were on your own, starting a search engine seems like an incredibly daunting task.

How do you actually go about doing that? It sounds super hard. Is it as hard as it sounds?

I don't know. I think I have a weird collective background.

Before that, I had run another company, and I was the only employee from beginning to end.

I think from that experience, had learned enough of all functions of a company to be like, enough to be dangerous, I guess, and be willing to start something.

For search in particular, it's like the confluence of all sorts of things I had some knowledge in and was interested in, like crawling websites and databases and information retrieval algorithms and stuff like that.

Just all things I've been personally interested in for a long time.

I started out doing what people think about, thinking back to the mid-2000s as search, which is crawling everything and indexing and putting it on the page.

I did that for a while, but quickly realized that actually was not the future of search, and that part of it, similar to browsers again, had reached diminishing returns in a way.

The rendering of web pages were similar from browser to browser. Actually, if you went to different search engines, the top 10 links were actually very similar in most search engines, but what I thought you could differentiate on was better instant answers, less spam in the results, better privacy, other things that are added value on top of what I was almost seeing as a commodity in the results, in the index results.

I eventually pivoted and said, I'm going to try to get those from somewhere else and then add value on top of all that and do more interesting things that hadn't been done before.

What was your background before?

What was the company you started and what were some of the things that were the confluence of events that allowed you to have the confidence to do this?

I went to MIT.

I was a physics undergrad and really started a company right out of school, educational software company, and hired people, my friends who were in computer science and other things, but I took it up on myself to do their jobs too so I could learn those aspects, including system administration and some of the stuff that Cloudflare started off doing.

Then the second company, that ended up going absolutely nowhere.

It was a great idea, but 20 years too early. We could talk about things like that.

The second company was really an early private social network.

If I had stuck with it, maybe it would be a good alternative right now with the Facebook case coming out, but what happened was it basically got eaten by Facebook early on.

Some of the things we did there was there was no advertising on the site.

It was more of a subscription service. It was really competing with classmates.com type of thing at the time, which is now anachronistic.

This was 2003, 2006.

This was a long time ago because I started DuckDuckGo in 2007. From doing that, I learned a lot about running a site with a lot of people and traffic coming through it and working with email protocols and things like that and scripting the web and stuff like that.

Maybe a silly question, but where did the name come from?

I assume it's a play on DuckDuckGoose, but what was the rationale? Not even really explicitly.

It just popped into my head one day. My company out of school was about increasing parental involvement.

It was an educational software company.

Its name was Learn Action, and it was the worst name. No one could pronounce it.

No one could spell it. Whatever I did next, I wanted a name that was memorable and fun.

I thought of the name before the company and was like, whatever I'm going to do, I'm going to use that name.

I don't have a great story. It just popped in my head. You said that Google, pretty early on, even before when you were just on your own, started to respond to you.

That must have been a giant $100 billion plus company comes after you when you've got this project.

What was that like? I remember the fight over Duck.com, which I think you have.

We were tiny at the time. That was still just me.

That was in 2010. They have a history. It wasn't just us. They were extremely paranoid to competition, which is somewhat coming out now in the antitrust case.

There were a lot of instances of them paying very close attention to tiny startups that could gain any amount of traction and trying to squash them in any way possible.

It seemed irrational to me. We were tiny. I kind of see it. What we're doing in terms of privacy, I think, is a real threat to their business model in general.

I can see their attitude of wanting to squash it. It's made me just want to do it more.

It's just to be like, this is really where an impact can be. Your business model still is advertising -based.

You display ads and you make, I think, most of your revenue that way.

How have you done that in a privacy-preserving way?

At some level, if you just sort of dropped into these pages, you were an alien from outer space and you did a search on Google and you did a search on Duck.Go, the experience for the ads seems somewhat similar.

Behind the scenes, it seems like you're doing some things that are more in a user's favor.

Oh, yeah, absolutely. We kind of run private advertising.

Taking a step back, let me get to your question. We started out this search engine, ran it for a decade privately, but then we've really branched out.

At the moment, our pitch to a consumer is really, I would call it the easy button for privacy.

We're not there yet, so this is a long-term story, but for all the people who kind of want privacy on the Internet but feel kind of powerless to get it, that's the call that we're answering.

If you could just kind of press the button and magically be private online and everywhere you use the Internet, so search and browsing, but also email and apps and payments, that would be our ideal solution.

We call it Privacy Simplified. I've heard you start to describe, when we first met you described DuckGo as a search engine and now you've described it as a privacy company, so it does seem like there's been an evolution there.

Yeah, exactly.

That's a brand education evolution. Because we've been growing exponentially, most of the people who know us are from the last two years, and so they've seen us more as the privacy company and maybe adopted our app, which is like a full browsing app with all these features, but we have all these people who knew us from 10 years ago who are like, you're a search engine.

And so I'm working on that kind of brand re-education.

But from that perspective, yeah, we offer this kind of all-in-one privacy solution, and right now it's really search and browse together with search engine, tracker blocking and encryption, and on mobile it's a full browser, on desktop it's a browser extension.

And we hope to add more to that over time.

But to your business model question, yeah, we make most of our money via private search ads.

And so what I mean by that is, this is actually the way Google started out making money before they started tracking you all over the Internet, which is when you type in car or mortgage or whatever you want to buy, you get an ad based on that keyword, not based on you as a person.

So we call that contextual advertising because it's based on the context of the page versus behavioral advertising, which is the stuff that follows you around and is creepy and whatnot.

And we just do that first time. It's like the old Internet before it got creepy.

We do contextual advertising all the time. Whereas Google has not only kind of layered on behavioral advertising onto Google search, but they actually use your search query to power ads in all their other properties like YouTube and Gmail.

But also what people don't realize about Google is they run ads for most of the Internet, which is they're on millions of websites and apps, and those ads that are following you around are generally keyed all the way back to your Google searches.

And so when you just do contextual advertising, though, it just kind of stays siloed into your search engine.

And then we layer privacy on top of that. We don't have any user sessions or user history of search histories at all.

But that's really the difference.

So let me see if I explain this and if this is right. So when somebody searches for something, let's say you search for blue Chevy Aerostar van on DuckDuckGo, then you go out to your advertisers and you say, hey, someone, I don't know who they are, but somebody is searching for a blue Chevy Aerostar van.

Maybe you have some data on where I'm located so you can go to a dealer that's in wherever I am around the world.

But there's something about that. It's not Matthew is searching for.

It's just someone out there located in this part of the world is searching for that.

And then does anybody want to show an ad in that? And then you show the ad.

And if I click on it, then I might go buy a Chevy Aerostar van or not.

And the merchant's able to get that. But you don't then make it so that when I go to the New York Times or when I go to whatever else, the blue Chevy Aerostar van isn't following me around the rest of the Internet.

Is that roughly right?

That is. That is exactly right. And then the only thing I add to that is if you have our kind of technology to the browser or the extension, when you click on either that site or another site, just the results like the ad, but going to a site about the Chevy van, like we are blocking Google and Facebook and all the other companies, trackers on that site.

So they can't even use your browsing history to do that same ad targeting across the Internet, because a lot of third parties are just lurking on websites, not even just on the search engine or just behind the scenes, just trying to figure out that you even landed on a page about the Chevy van.

So a question I've always wondered, because Google, when they launched, was actually kind of similar to the way that you're doing.

And again, as you said, they've added the behavioral advertising on top.

Do you have any sense of if Google tomorrow just said, we're going to get rid of all the behavioral advertising, we're going to go back to just purely contextual.

Yeah, I mean, so last year I wrote a New York Times op-ed with this exact premise.

And I believe that both Facebook and Google could turn to completely contextual advertising and still be among the most profitable companies in the world.

I think it's about putting kind of, there's kind of two reasons why I think you're doing.

I think there's one of just like a capitalist story of, you know, putting profit before people and kind of squeezing out every last amount of profit.

So not just being one of the most profitable companies in the world, being like the most profitable company in the world.

And they've kind of crossed that line. And the other is a strategic reason.

So this gets a little more nuanced, so feel free to take me on a different line of questioning.

But like, you know, Google and Facebook are an advertising, digital advertising duopoly, right?

Most people go to them, not necessarily at all, because behavioral advertising is more, is better or anything for the advertiser.

In fact, there's a lot of studies now that show that it may not be that contextual advertising may be just as good, but they have amassed most of the audience.

And they're really only offering behavioral advertising.

And what that's done is made them the only places to get behavioral advertising because they're the only ones with the audience and kind of developing that technology.

And what that means is the contextual advertising market has just been starved of dollars and innovation and venture capital and everything for the last 10 years.

And so one hope that we have in kind of like the regulation perspective that we've been advocating for is a real key to some kind of do not track setting, a modern one.

We proposed one recently called the global privacy control.

And that if every one consumer, say, could opt in to a setting in their browser that says, I don't want to be tracked by Google and Facebook across the Internet, all of a sudden, say like 30% of people opted into that.

It's a huge market for contextual advertising.

And then maybe we can grow that market again. One of the things that I worry about is a lot of our customers are publishers.

Some of those publishers generate revenue from the advertising, which is on their pages.

And advertising at some level is like the one micropayment that works at scale.

Where someone targeting me with an ad, the rate that they get for that is much more than the rate that they get from some kid who's a computer genius based in Bangladesh and just trying to learn about whatever the latest programming is.

And yet you make enough from the kid in Bangladesh, you make something.

So it makes sense to open content up and democratize it.

I think as this sort of advertising space has gotten more and more and more squeezed, you're seeing more content end up behind paywalls.

And again, that's fine for you. It's fine for me. We can afford to pay for it.

But that kid in Bangladesh, I feel like they're all of a sudden at a huge disadvantage.

I know Brave has sort of thought about some of how to do that, and I think with moderate success.

But as you shut down some of the ability for publishers to earn as much from the ads that are on their pages, given the ecosystem today, what fills that in the future?

Or is all content going to end up behind subscriptions and paywalls?

You've thought a lot about this, and I'd be curious to hear what you think.

Yeah, I don't think it has to. And DuckDuckGo is not anti-advertising, to your point.

We make most of our money via ads, just private ads, right?

And we also make a big distinction between our privacy solution is not an ad blocker.

It is a tracker blocker. It blocks unnecessary tracking. But if you're doing good private advertising, like contextual advertising, we have no interest in blocking that and would like to even support it.

And some of these efforts, like I was referring to the GPC, I think if we can get these going from either our own kind of industry perspective, which we're trying to do, or getting help from regulators, we could breathe life into this contextual advertising market.

And to put a point on that a bit, the difference between kind of how that could work in practice, right, is right now, for example, the biggest tracker on the Internet is Google Analytics.

So it's Google's analytics service.

It's free. 75% of the top million websites have it lurking on the site. And they use it and they're trying to use it for themselves to like make their either advertising better or their marketing better or their site better.

But in reality, it's also slurping up the browsing history and adding right to the behavioral profile for Google.

Now, we block that tracker. Interestingly, most major browsers do not block that tracker.

You could ask why, but they don't. And so you need something like DuckDuckGo to block it.

But it doesn't need to be that way, right?

So you can have an analytics piece of software, and I know Cloudflare recently launched analytics software, right, that is just first party, you know, like it doesn't, it's for the site, you can get the same results, but you don't need to also add to this behavioral profiling ecosystem.

So I think that's the future is like services that come up that help publishers that stay within their kind of first party data silo.

Yeah, I mean, it's amazing. I remember that, you know, we installed Google Analytics on, you know, a bunch of projects and other things, because we were trying to, before Cloudflare, because we were trying to just understand like, who's going to the site?

And are they using it? And it was a simple, easy way of doing it.

And I looked back at some of those things, and there's still Google Analytics tags on all of those pages.

And so when we, there is, if you're building a site that you are doing behavioral advertising to drive traffic to and those things, then Google Analytics is a tool that really has done that.

But our motivation behind launching the Cloudflare analytics solution was to say, listen, if all you need is just to know how people are interacting on your site, let's build something that is very privacy preserving.

And our, you know, a lot of times people ask, what's the catch?

And the catch is, well, we hope then you'll discover Cloudflare, and then you'll sign up for the services that you pay us for.

And so it's really, I mean, it's, this isn't a charity, like we're still doing this as a way to do this.

But the business sense makes sense for kind of the more private Internet as well.

So it's been amazing to see how much that's really resonated. Do you, is it, you know, one of the things I was really, I used to teach privacy law.

And, and I, and we, and the people would sign up for my class were like, you know, I don't use Facebook, and I, and I block everything.

And, and then, and then I would, I would ask them, well, you know, how many of you when you went shopping the other night used your, your grocery store discount card?

And everyone's like, of course I did, you know, I got 18 cents off grapes.

And I've always been sort of, I mean, it's been disheartening to see how quickly consumers are willing and for how little they're willing to give up their private information.

Do you see something changing in that, in that world?

Or, or, or is there, is there, is there hope that people care more about this going forward?

Or, or is this, again, what I've always worried about is people talk about privacy a lot, but at the end of the day, you know, it doesn't take very much for them to give it up.

Yeah, I mean, which is termed often the privacy paradox.

So I think the privacy paradox after saying this for a bunch of years now is somewhat of a myth.

And so it can be unraveled, even in the, even in the kind of loyalty case for coupons, if people really understand what's happening with their data.

And so like, even in the, like the grocery case, people generally don't realize that data is being sold to third parties.

They think it's still just being used by the grocery store and they're okay.

You know, privacy is, is, can be a trade-off in different areas, right? Like if you're getting something for it, you know, you might want to make that trade -off in certain cases.

And there's, there's crime, you know, trade-offs that people make and things like that.

The problem with it is, is no one's really making that trade-off in a lot of these cases, because they haven't been educated as to what's really going on.

And when you actually kind of pull the curtain back and say, actually, it's not just you getting a coupon here, but your data is getting sold.

And that's why you're getting all this junk mail and targeting, and it might lead to discrimination against you and not getting certain job ads online and all these other things.

People are like, and people have done this study. They're like, whoa, I actually, I don't, I won't take the loyalty card anymore, you know?

So I think that unravels the paradox.

Now to the, to your kind of underlying question, we measure, because we think our audience is the group of people who not only say they care, but will actually do something about it, right?

Will act. We call that the care and act on privacy group.

And we've been trying to figure out ways to measure that group.

And it has really been growing. And it, you know, the two inflection points, this is, you might just guess this, we're kind of snowed in back to the 13 and then Cambridge Analytica in 2018.

And it wasn't just that those were revealing, it's that the media then spent the next couple of years kind of like educating some of the stuff that was happening behind the scenes.

And if we do that too, like part of our brand story, we explain like all this hidden web tracking.

That's like the aha moment for people.

They're like, yes, I don't want my data sold and things like that.

And so we can basically expand that market. I think in the long-term asymptote of that is like the people who care actually do care.

They just don't really understand either what to do about it or how it really works or really what they're giving up, you know?

And there's a bunch of kind of studies and statistics I could recite, but the basic idea is once people understand kind of what's under the kimono, they're like, okay.

I will like back off some of this stuff.

One of the things that you've talked about is sort of the role of regulators.

We just saw it the other day, the Facebook lawsuit, which was really focused on competition, but privacy snuck in a lot of that and actually how the sort of lack of competition in that space has kept people from competing on privacy.

Any thoughts on sort of the sort of recent regulatory actions coming out of the U.S.

against both Google and Facebook?

Yeah, definitely. A couple of broad thoughts. I mean, there's one kind of just general school of thought that like, you know, we need regulatory action in this area.

And I agree with that, but it doesn't follow that we need that to solve some of our consumer privacy problem today.

Like our kind of pitch for our product, and I think part of Cloudflare's pitch and some of its products is, you know, you don't need regulation to solve some of these problems.

Like we're offering you a solution today that you can, if you've kind of fed up with all this stuff, you can do something right now about it.

That said, we're still, and I think Cloudflare is too, advocating for good regulation to help clean some of this up even further and make it so that these markets are just like more competitive and kind of better.

So with that being said, yeah, I think privacy is at the core of both of these suits, really, for two reasons.

One is the consumer harm, and especially this case in the Facebook cases yesterday, articulated is that Facebook has gotten worse and worse in privacy, and that is part of the harm that people don't have any alternatives.

And the same is true with the Google case, is that while they can use our takeover search, Google's been holding us back, and we think if they weren't kind of tying up all the exclusives, we'd be literally 10 times bigger than we are now.

Like we're proud to be number two in mobile search in the US, but, you know, we're about two to 3%.

We think we would be like 20% if like you could just choose your search engine when you install an Android device or, you know, an iPhone.

So I think that like privacy is really at the center of these conversations, and that if the actions were to kind of go to fruition and have good results from a consumer perspective, like you would have all these other kind of private alternatives kind of blossom, us being one of them.

So we have about two minutes left. And so this is that this is maybe maybe a question that that's not gonna be enough time for but if you had sort of your, if you had to sort of your regulatory druthers, what would be what would be sort of your advice to regulators is there, is there thinking about the space that the things that make sense for there to be regulation and then maybe the things that make sense for people that sort of state stay out of and let the competition deal with.

Yeah, a brief answer. I mean, I think in search market in particular, you kind of need consumer put consumers in control and be able to choose their provider.

That's kind of what we're asking for more broadly, like the central competition issue with Google and Facebook is the same it's it's massive data collection, and the data monopolies that result from that and all the harms fall from the data collection discrimination polarization filter bubbles, it's all the same stuff used for ads is the same stuff for all that stuff.

And so you got to do something about data monopolies, there's a lot of things you can do in terms of remedies but that's the core thing you got to focus on is how to reduce the data monopoly.

And you're so you you branch out from search to doing browsing.

What are some of the, what are some of the other things that are kind of on on your radar roadmap or just ideas that are bouncing around in your head and your team said.

If you think of privacy simplified, you know you're tracking all sorts of other places you're tracking your email you're tracking other apps you're tracking payments tracking social media.

All of those areas are areas that if we were succeeding to our full vision we would have some part of our solution to help you with.

Yeah, well, Gabe, I really appreciate you you're someone that I've admired for a long time and I might admire go and we try and do live up to the same privacy principles ourselves at at Cloudflare and so so make make sure that we that we do that and and and for anyone who's watching give duck duck go try I think you'll you'll be surprised how much it can really replace your everyday search experience and and your browsing experience so appreciate it Gabe thanks for thanks for joining us and Cloudflare TV.

Thank you. Take care. Bye.