Under the hood, things are more complex. Greg Fiorentino, product director at DuckDuckGo, says when you enter your personal information into the system, it’s all stored in an encrypted database on your computer (the tool doesn’t work on mobile devices) and the company doesn’t receive that information. “It doesn’t go to the DuckDuckGo servers at all,” he says.
According to Fiorentino, DuckDuckGo looked at the URL structure for each data broker website: search results may include, for example, the name, location and other personal information requested. When the Personal Information Tool searches for you on these websites, it creates a URL with the information you enter.
“Each of the 53 locations we cover has a slightly different structure,” says Fiorentino. “We have a template URL string where we replace the data of the user to be searched. There are a lot of different nuances and things that we have to be able to deal with to actually match the data correctly.”
In testing, the company found that most people had between 15 and 30 records on the data broker sites it reviewed, but the high was around 150. Weinberg said he added six addresses to be removed from sites . “I found hits on old stuff, and even in the current address, which I’ve really tried to hide from spam a little bit, it’s still kind of out there,” Weinberg says. “It’s really hard to prevent your information from becoming public.”
Once the search for records is complete, the DuckDuckGo system automatically makes requests to remove the records using a similar deconstruction of all data broker websites, according to the team working on the product. Fiorentino says some opt-outs occur within hours, while others can take weeks for the data to be removed. The product director says the tool may be able to remove data from more websites in the future, and the company is considering possibly including more sensitive data such as financial information in the opt-outs.
There are various personal data removal services available on the Internet, which may vary in terms of the data removed from websites or the services they provide. Not everyone is trustworthy. Recently, Mozilla, the creator of the Firefox browser, stopped working with identity protection service Onerep after investigative journalist Brian Krebs revealed that Onerep’s founder had also founded dozens of people search websites in recent years.
DuckDuckGo’s subscription service marks the first time the company has charged for a product – its browser and search engine are free to use, and the company makes its money from contextual ads. Weinberg says subscriber details are not transmitted to DuckDuckGo’s servers because subscriptions are purchased through Apple’s App Store, Google Play or through payment provider Stripe. When signing up, a random ID is created for each user, so users don’t have to create an account or give DuckDuckGo their payment information. The company says it does not have access to people’s Apple IDs or Google account information.