One Friday in April, piracy sites went missing from the search engine DuckDuckGo’s index.

“Holy sh*t!” we thought. “Has DuckDuckGo decided to step up and help the creatives whose livelihoods are harmed by widespread piracy? Could they be a shining example of accountability amidst an irresponsible group of Silicon Valley titans?”

Nope – not even close.

Like other observers who thought DuckDuckGo had taken action to prevent infringement, we were surprised to learn that the piracy links had disappeared only because they were delisted by Microsoft’s Bing – one of many services which DuckDuckGo uses for web indexing. Far from implementing a constructive policy to fight piracy, DuckDuckGo was working urgently to add the criminal sites back to its search results.

When Microsoft’s delistings rippled through DuckDuckGo, the startup’s founder-CEO Gabriel Weinberg tweeted that popular piracy tools “have actually been continuously available in our results if you search for them by name (which most people do).”

Oh? Well, that’s just fan-f*ckin’-tastic.

When TorrentFreak publicly reported sites for which Weinberg’s claim didn’t hold, DuckDuckGo took note, and quickly and quietly restored each one to its index, presumably by hand.

We were disappointed in DuckDuckGo. When the truth came out, we had to delete our tweet celebrating DuckDuckGo as an example of #PlatformAccountability.

What’s even stranger about all of this is that DuckDuckGo bases its “[p]rivacy, simplified” promise on its refusal to track users to serve them personalized ads. But DuckDuckGo seems totally and inexcusably oblivious to the fact that they are putting their users’ privacy at risk by listing piracy sites.

Piracy’s Privacy Risks

As we’ve pointed out before, piracy sites are notorious for exposing visitors to identity theft and malware.

According to data gathered by Digital Citizens Alliance, one out of every three piracy sites distributes malware alongside infringing content. Moreover, the risk of malware is 28 times higher on infringing sites than on legitimate parts of the web.

The U.S. federal government agrees that piracy sites pose serious security risks. In 2019, the Federal Trade Commission (FTC) renewed its warning against free movie or television sites, adding that criminals have increasingly been spreading dangerous apps and devices.

As the FTC advised, “If you want to avoid downloading malware when you stream video, don’t watch pirated content. Period.”

Since DuckDuckGo claims to care so much about privacy, don’t you think that they should hesitate before serving up their customers to some of the worst abusers on the planet?

Search Results Matter

What makes DuckDuckGo’s actions so maddening is that search results really do impact consumer behavior – and thus safety.

According to researchers at Carnegie Mellon University, college-aged as well as older adults are more likely to click highly ranked links. As you might expect, a search engine’s top hits get the most site visits, whether they are legal or illegal.

More surprisingly, though, these researchers also found that search results can alter people’s decisions about where and how to view content, for better or worse. Internet users planning to pirate films or television episodes often end up paying rightsholders when offered a list of legal options.

By the same token, users willing to buy content from legitimate sources frequently turn to piracy when confronted with lists including criminal sites.

A recent study from Australia similarly showed that search engines’ indexing and delisting practices matter. While the most determined pirates directly navigate to their favorite illicit sites, others rely on search results.

In addition, many pirates report finding piracy recommendations on social media, suggesting we could use some platform accountability there, as well.

Who’d have thunk it? Us. We would have thunk it.

Disappointed Once Again

DuckDuckGo promotes itself as a “privacy-first” alternative to Google. But even Google has begun to delist piracy sites, finally taking some responsibility despite its “Don’t Be Evil” record. It has been a good, if halting, first step.

Privacy protections are DuckDuckGo’s primary advantage in the marketplace, but protecting users from abusive advertising practices isn’t enough. To fulfill its promise of “[p]rivacy, simplified,” DuckDuckGo needs to do its part to protect users from cybercriminals, as well. That means delisting piracy sites to reduce customers’ exposure to malware and identity theft.

Creatives as well as everyday users deserve a better, safer internet – one that truly values privacy. The Silicon Valley model of “profits first, integrity later” has already exploited far too many people for far too long.

Internet startups shouldn’t be rewarded for using many of the same socially irresponsible tactics as their predecessors. If DuckDuckGo wants to regain our support, then they need to break the Big Tech tradition of trading consumer well-being for commercial viability.