If DuckDuckGo built an analytics tool

DuckDuckGo does not make a web analytics product. It has not announced one, it has not hinted at one, and nothing on this page should be read as suggesting otherwise. This is a thought experiment and nothing more.

It is a useful one, though, because DuckDuckGo has spent seventeen years writing down exactly what it will and will not do with data, in unusually plain language, and those commitments are specific enough to be treated as a design brief. If you take their published principles seriously and apply them to the problem of counting visitors to a website, you do not end up with a vague aspiration towards privacy. You end up with a short list of engineering decisions, most of which rule out most of the market.

So this page does that exercise. What follows is my own reasoning applied to their public statements, not their plan, their roadmap or their opinion.

What DuckDuckGo actually commits to

Start with what is published rather than what is assumed, because the detail matters and the detail is where the specification comes from.

Their privacy policy opens with five words: they do not track you. The brevity is itself a design statement, and it is worth noticing that a policy short enough to read in a minute is a policy that cannot hide anything in paragraph forty.

The substance underneath it is more precise than the slogan. They state that a visiting device sends its IP address, browser type and language automatically, and that they use this information temporarily to deliver content and, for security, to establish that the request is not from a malicious bot. They state that they never log IP addresses to disk in a form that could be tied back to a person, and that they never log unique identifiers to disk that could be tied to a person or to their history. They describe the consequence in a sentence worth quoting because it is the whole design: they may know that a lot of people searched for something today, and they do not know who.

And the founding principle, from their own about page, is the one that generates everything else: the best way to protect personal information is to stop it being collected at all.

What those principles force, applied to analytics

Run each commitment against the problem of counting website visitors and the design space collapses quickly.

No identifier written to disk rules out cookies immediately, and it rules out the weaker cookieless designs too. Storing a stable hash of an IP address is storing an identifier, whatever it is called in the marketing. The only construction that satisfies this is one where the identifier is derived per request and cannot be recomputed later, which in practice means a salt that rotates and a previous salt that is destroyed.

The IP address used temporarily, never logged is a stronger requirement than anonymising an IP after storing it, and stronger again than truncating its last octet. It means the address exists in memory for the life of one request and is gone before the response is sent. Nothing in a log, nothing in a database, nothing in an object store.

Aggregate knowledge without individual knowledge is exactly what an analytics dashboard is for. Knowing that four thousand people read a page today, and being unable to say who any of them were, is not a compromised version of web analytics. It is the entire product, and almost everything sold on top of it exists to serve advertising rather than the site owner.

Bot detection as a legitimate use of transient data is the quiet one, and it is the most interesting. DuckDuckGo explicitly names spotting malicious bots as a reason it may look at a request before discarding it. Applied to analytics, that is a licence to filter automated traffic out at the door, which matters because roughly a third of what arrives at a typical site is automated and most tools count all of it.

What it would refuse to build

The negative space is more revealing than the feature list, and this is where most of the market falls out.

No cross-day visitor identity. Returning-visitor reports, thirty-day attribution windows and cross-device stitching all require recognising a person over time, which is the thing being ruled out. A DuckDuckGo-shaped analytics tool would not offer them, and would say why rather than burying it.

No free tier funded by the data. This is the sharpest consequence and it disqualifies the most popular tools in this market. DuckDuckGo's own statement is that it makes money from privacy-respecting search advertising rather than by exploiting user data. An analytics product built on that principle cannot be free in the way Google Analytics or Microsoft Clarity are free, because both of those are paid for by the value of the data to an advertising business. It would charge a subscription, and the subscription would be the entire business model.

No raw session content leaving the browser. Session replay is not automatically disqualified, but capture-then-redact is. If the principle is to stop collection happening at all, then masking form contents after receiving them is the wrong way round: the data has already left the visitor's machine. The only construction consistent with the principle masks every input in the browser before transmission, and makes you opt individual fields back in rather than opting sensitive ones out, so that a misconfiguration results in seeing less rather than in holding something you promised not to hold.

No consent banner. Not as a feature, but as a consequence. A tool that stores nothing on the device and retains no identifier has nothing to ask permission for, and a company whose product is an ad blocker would find it absurd to ship something that greets every visitor with a dialogue.

What it would look like on the screen

DuckDuckGo's design instinct is reduction. The search page is a box. The privacy policy is a sentence. The browser's headline feature is a button that clears everything.

An analytics product built by that instinct would not have a hundred and forty-seven reports. It would answer the three questions a site owner actually has, on one screen, in about a second: who came, what did they read, and did they stay. Sources, top pages, and a live view for the hours when live matters. Goals, because a number with nothing to compare it against is decoration.

It would also be small. A company that ships an ad blocker and publishes tracker-weight comparisons is not going to hand your visitors forty kilobytes of JavaScript on every page view. The script would be about a kilobyte, it would have no npm package and no build step, and installing it would be a paste rather than a project.

And it would tell you plainly what it cannot do, because a short honest policy is the house style.

The awkward conclusion

Write that specification out as a list and read it back.

An identifier that rotates daily and cannot be recomputed. An IP address held in memory for one request and never written to disk. Aggregate counts with no individual behind them. Automated traffic filtered at the door rather than counted. No cookie and therefore no consent banner. A subscription rather than a free tier funded by the data. Session recording masked in the browser before transmission, opt-in rather than opt-out. A script of roughly a kilobyte. Three numbers on one screen rather than a reporting suite. An honest account of what it will not tell you.

That is not a hypothetical product. Every line of it describes something already on sale, and the tool it describes is the one at the top of this site's ranking. I did not arrange it that way: the exercise was to derive a specification from DuckDuckGo's published commitments, and this is where it landed.

The honest reading is not that anybody copied anybody. It is that there are only a small number of ways to build measurement that genuinely cannot identify people, and once you commit to the principle the engineering conclusions are close to forced. Two organisations reasoning from the same premise arrive at the same architecture, which is roughly what you would hope for from a principle worth holding.

The rest of the field

Common questions

Related guides