DuckDuckGo’s Android anti-tracking protection does what Google won’t

For folks who want to protect their privacy, using an Android phone can feel like a compromise.

While Apple has been aggressive about building anti-tracking tools into iOS, Google is still working on a way to let Android users opt out of being tracked across apps. And unlike Apple, Google—whose whole business is based on keeping tabs on users to target advertising—won’t require app makers to get opt-in permission if they want to track you in the first place.

So now, privacy-centric search company DuckDuckGo is stepping in with its own privacy protections for Android users. A new App Tracking Protection feature in its Android app will automatically block third-party trackers across all other apps. Users will also be able to see which apps want to track them and where they’re trying to send data.

Not quite like Apple’s version

DuckDuckGo’s anti-tracking system works by setting up a firewall that blocks all traffic to sources that it identifies as trackers. While Android classifies this as a virtual private network, or VPN, DuckDuckGo notes that it’s not routing app data through remote servers. Instead, all the blocking happens locally on the device itself, so there’s no trade-off in connection speed or concern about your data being compromised.

To identify potential trackers, DuckDuckGo says it tests popular Android apps to see what kind of information they send, including identifiers, device information, email addresses, and GPS information. If a sites collects a certain threshold of identifying information, DuckDuckGo classifies it as a tracker and cuts it off from receiving any data.

[Animation: Duck Duck Go]Note that on iOS, Apple doesn’t directly block any trackers. Instead, selecting “Ask App Not to Track” when prompted prevents that app from seeing your advertising ID, which it can use to track users’ activity from one app to the next. While Apple says that apps should honor this request by not tracking user through other methods, some apps disregard those rules and continue to track users anyway.

That means DuckDuckGo is going a step further than Apple, proactively blocking traffic regardless of what permissions they’ve sought. (On iOS, a free app called Lockdown provides a similar layer of extra protection.)

Following the tracker trail

Taking a peek at DuckDuckGo’s tracking log can be insightful. Here’s just a small sampling of what the app blocked during a typical day of my phone usage:

• Six attempts by Twitter to reach Innovid, a firm that specializes in targeting users with ads on streaming TV devices.
• 73 tracking attempts in Yelp, including calls to the tracking firms Braze and Branch Metrics.
• 11 attempts by my bank to reach Adobe, which offers an array of ad targeting products.
• Attempts to reach Google by Ecobee, Spotify, Jimmy John’s, and Yelp.

Keep in mind that not all tracking attempts are nefarious: Many apps use external analytics tools to track bugs and understand how people are using their products. DuckDuckGo makes no attempt to distinguish these benign trackers from those that might be trying to target you for ads.

Without scrutinizing individual trackers yourself, it’s easy to get the wrong impression about what your apps are up to. DuckDuckGo’s App Tracking Protection feature would be better if it provided more details on each tracking source, so that users could understand what’s happening on their phones instead of just assuming the worst.

Work in progress

DuckDuckGo also notes that it doesn’t block trackers in certain apps that depend on tracking to function. The app doesn’t block track trackers in games, for instance, as these often rely on showing targeted ads as players progress. A quick scan through my app list reveals known issues with WhatsApp and the NFL app, and DuckDuckGo says it’s also disabled blocking for CBS News, Chipotle, and Wayfair.

While you can manually enable blocking for those apps, doing so can prevent them from working properly. DuckDuckGo is hoping to minimize those issues as part of its private beta testing.