Privacy has been pushed to the forefront of most people’s minds in the last two years. A renewed awareness began in 2012 with the Snowden revelations, but its embers have been continuously kindled by non-governmental intrusions like the Target data breach and wariness over just what information apps like SnapChat and Whisper–as well as long-standing Internet giants like Facebook and Google–actually know about us and which of our personally identifiable data they decide to keep on their servers.
Perhaps it’s no surprise then that new businesses have sprung up around privacy itself. But in the technology sector, monetizing privacy is hard.
Sure, there’s startups like Blackphone and Vysk that make money by selling hardware, but where software is concerned it’s difficult to turn a profit if you don’t directly monetize your users’ data (as Google, Yahoo, Facebook, and virtually every Internet giant does). Of course you can sell your services direct to users, but that’s a hard pitch when you are trying to grow your user base; besides people expect software for free nowadays.
But one startup had a plan to promote, spread, and enable user privacy–and actually make a living from it. They created the Epic Privacy Browser, which allows you to browse the web in complete anonymity while at the same time showing them relevant ads from Google. Privacy and profit were hand in hand. That is, Epic’s creator says, until Google changed its terms.
The easiest way to describe Epic is by saying it’s similar to Tor, but extremely user friendly and works on the regular Internet. It’s similar to Tor because it allows anyone to browse online while at the same time allowing them to remain completely anonymous to the sites they visit and the services they use. But unlike Tor, which allows you to browse the dark web, Epic is an everyman browser that enables you to surf the web you already know and love. It’s also dead simple to install and use with virtually zero setup–just download and go.
Like most things on the web, Epic has indirect ties to Google. First, it’s based on the Chromium source code released by Google, which is also what Google Chrome is built on. Second, Epic uses Google ads, which are displayed to users when they search. This is how Epic makes money to pay its developers to continue working on Epic to enable a more private online experience for everyone.
Chrome also has a privacy mode built into the browser–it’s called Incognito. However, contrary to what many might assume about Incognito, the privacy mode in Chrome does not make you anonymous to most websites or Google itself. Incognito does not prevent against most remote tracking of search histories or other information about you obtained via cookies. What Incognito does do is protect your Internet usage history from others who may be using the same computer you are on. It’s local protection, not an online anonymity tool.
As for ads, we all know Google is an ad company and you, the user, are its consumer. Google’s services like Maps and Search are both a benefit to the end user and also a way for the company to record more information about their product (i.e., you) so they can package and sell more relevant info to their customers, the advertisers. Sure, it sounds kind of creepy when put that way, but it’s a valid business model and it has made Google one of the most profitable and powerful companies the world has ever seen.
Epic, on the other hand, is the exact opposite of Google and Chrome. Its browser destroys all cookies, history, and cache every time you exit the browser, while also maintaining complete anonymity by running all your searches and web usage through a proxy. The result is no sites or advertisers can track you or personally identify any characteristics about you. For what it’s worth Firefox has just announced a “forget” button that mimics Epic’s features, but doesn’t have the advantage of running your browsing history through a proxy.
As for the ads Epic serves to its users, they are designed to still be relevant while not compromising a user’s privacy because Epic masks every single user’s IP address. Epic then provides the masked IPs to one of Google’s ads providers, a company called Blucora that sells private-label Internet search services–including Google ads–to companies. Blucora then returns ads relevant to the Epic user’s geographic location without Epic, Blucora, Google, or the advertiser ever knowing where specifically a user is–or where they have browsed online.
It is perhaps an inelegant solution, but one that solved the problem of keeping a user anonymous while still providing value for advertisers and a revenue source for Epic.
“We had a great deal where we would send a masked IP address to them to get the ads. That was that system that we had set up with them,” says Epic’s CEO and founder Alok Bhardwaj, 39, when I ask about the original arrangement that Bhardwaj saw as a win-win for both companies. Bhardwaj is no stranger to negotiating deals that benefit all parties involved. Before Epic he started out in finance advising technology companies on mergers and acquisitions as an investment banker with a boutique acquired by the French bank Societe Generale. After leaving that he worked as a teacher and tutor and also authored research papers on the telecommunications, technology, and gaming industries at the Columbia Business School. “Google needs to know the IP address of whoever the person is that wants to see the ad, so they know if it’s relevant for the advertiser and if that’s what this advertiser is really paying for. So that’s why Google wants the IP address. But then when we masked it, but we would mask it in such a way that Google still gets all this geo location data; they know where this person is, but they just can’t personally identify that person.”
And things were going great for almost a year until one day Blucora informed Epic that Google was now requiring the true IPs of every user who viewed their ads. Epic refused and Google cut off their ads. And like that, the privacy browser’s revenue sources were severed.
When Blucora informed Epic that Google was cutting off its ads Bhardwaj says he tried to reach out to Google, but had no success. He also says he worked with the ad intermediary Blucora to try to convince Google to go back to its original agreement.
“Our partners were trying to help us,” says Bhardwaj. “They were basically trying to talk to Google and say, ‘Hey, you know it would be great if you guys could continue to support the same kind of masked IP address privacy-protecting measures that you had supported before.’ They were trying to get Google to support all of that, but Google basically just said ‘no.’”
Blucora declined an invitation to be interviewed when contacted, only asking if I’d spoken to Google.
A Google spokesperson did confirm the changes in its terms now requiring actual IP addresses for ads, but said that these changes were not directed at any one company. Instead the changes to the IP requirements were just one part of a set of changes to improve the ad experience for both advertisers and users. Google says the changes made it faster to load ads on their sites as well as making it easier to push updates to partners very quickly so everyone has access to the same quality of ads.
As for changing the terms of requiring real IPs instead of masked IPs, the Google spokesperson said that was done because verifying actual IPs is a very important signal the company uses to weed out fraud–something that costs online advertisers $6 million a month. The Google spokesperson was also quick to point out that none of its changes were directed specifically at Epic nor are they suggesting in any way that Epic was involved in any kind of fraud. They also noted that Epic was not in violation of any of Google’s policies, it was just the technical implementation of what Google needed on Google’s end to make the ad systems work.
Bhardwaj says Google’s explanation is “not very compelling” given that there are numerous methods to detect fraud. Yet while he knows exactly what he needs to do for Epic to start making money again–hand over Epic’s user’s real IP addresses to Google–it’s not something he’s willing to do.
Instead, Bhardwaj has filed an official complaint with the Federal Trade Commission, saying the company would like to see regulatory oversight requiring Google to provide search ads to all competing browsers if the browsers are willing to pay for those ads.
In spite of the monetization problems Epic has encountered in trying to make privacy a profitable business model, Bhardwaj says he is not deterred. He’s currently collecting donations to cover development costs as well as speaking with other ad providers.
“We do continue to talk to Microsoft and Yahoo, but both of those guys as well are actually not particularly inclined to support private search ads for us,” he says. “Our hope is that as we keep growing, that maybe we can motivate those guys from a financial perspective to move, but neither of them are particularly inclined either to support private search ads.”
There are other businesses that could benefit from a privacy browser that also serves ads, such as Snapchat or Ello. But those companies are still figuring out their own revenue models, and aren’t in a great position to champion the Epic cause.
Nevertheless, Bhardwaj believes business models that support consumer privacy are inevitable, and Epic will be there to support them.
“Privacy is essential to freedom. We do thousands of searches and visit tens of thousands of websites a year. We send to the Internet now our stream of thought. Google knows more about you than your mother or your spouse if you use Gmail, Chrome, or Google search,” says Bhardwaj. “We believe we’re not the only ones uncomfortable with that and believe there should be consumer choice.”
The Epic Privacy Browser can be downloaded here.