Privacy driven search: what it really means for an Irish business

The point: privacy search is small, privacy browsing is not

When I first wrote this piece, the story was flattering: privacy search engines such as DuckDuckGo, Brave Search and Kagi were growing, their users were discerning, and early optimisers would win a loyal audience.

Little of that holds up. In Ireland the privacy engines carry around one search referral in a hundred. Most borrow Bing's or Google's index rather than run their own. And I found no evidence that their users are more loyal or more brand sensitive, so that claim is gone.

What did grow, quietly, is privacy in the browser. A third of Irish page views happen in browsers that block or isolate third party cookies by default, Safari now limits known fingerprinting scripts, and Irish law has required a yes for tracking cookies since 2011. That shift touches every visitor you have, whichever search engine sent them.

So this article answers one question: what does privacy driven search actually mean for an Irish business, and what is worth doing about it? The short answer is that being found by the privacy engines is mostly a Bing job, being trusted by privacy minded visitors is mostly a page job, and measuring either needs your own server, not just your analytics.

One invented business carries every example. Shandon Paper is a stationery shop in Cork, run by Ciarán, selling notebooks, fountain pens and ink online at shandonpaper.example. Every number about it is made up. The market figures, the search engines' documentation and the law are real, and footnoted.

How big the privacy search engines really are in Ireland

The most used public source for search engine shares is StatCounter. It is worth knowing what it measures before quoting it. StatCounter does not count searches. It counts search engine referrals: clicks from a results page to one of the sites running its tracking code, which it says is installed on more than one million sites worldwide.¹ So a share on StatCounter means "the share of clicks arriving from search at sites in its network", not "the share of people who use this engine".

For October 2026, StatCounter puts Ireland at Google 92.98%, Bing 4.62%, Yahoo 0.92%, DuckDuckGo 0.84%, Ecosia 0.34% and Yandex 0.12%.² Brave Search, Startpage and Kagi do not appear in its Irish list at all.²

The horizontal axis lists the search engines StatCounter shows for Ireland. The vertical axis is each engine's share of search referrals for October 2026. The takeaway is the scale: Google is roughly 110 times the size of DuckDuckGo, and the two privacy engines on the list together come to about 1%. Bing, which feeds several privacy engines, is the second largest bar by a long way.

Two cautions. StatCounter samples only the sites that run its code. And a browser that blocks third party scripts may never be counted, so I would expect privacy minded users to be somewhat undercounted, by an amount nobody can tell you. Neither caution turns 1% into 10%.

The old version of this article said these engines were "growing steadily". I could not reach a dated StatCounter series for Ireland that shows this, so I have cut the claim rather than guess.

Worked example: what the shares mean for Shandon Paper

Ciarán's server logs show 20,000 visits a month from search engines. Before he looks at his own split, he wants a rough expectation per engine.

If his visitors behaved like StatCounter's sample, the expected visits from one engine would be his total multiplied by that engine's share:

$$n_e = N \times s_e$$

Here $n_e$ is the expected number of monthly visits from engine $e$, $N$ is Ciarán's total monthly visits from search, and $s_e$ is that engine's share of referrals, written as a decimal. Turning a percentage into a decimal and multiplying is explained in Foundations: percentages.

Step by step: DuckDuckGo $20{,}000 \times 0.0084 = 168$. Ecosia $20{,}000 \times 0.0034 = 68$. Bing $20{,}000 \times 0.0462 = 924$.

Now what those visits are worth. Ciarán's conversion rate from search is 2.0% and his average order is €38. The expected monthly revenue from one engine is visits times conversion rate times order value:

$$R_e = n_e \times c \times \bar{a}$$

$R_e$ is the expected monthly revenue from engine $e$, $n_e$ the visits from above, $c$ the conversion rate as a decimal, and $\bar{a}$ the average order value. A conversion rate is a rate, see Foundations: ratios and rates, and a probability times a payoff is an expected value, see Foundations: expected value.

DuckDuckGo: $168 \times 0.02 \times 38 = €127.68$ a month. Ecosia: $68 \times 0.02 \times 38 = €51.68$. Bing: $924 \times 0.02 \times 38 = €702.24$.

So the privacy engines alone are worth about €180 a month to Ciarán ($127.68 + 51.68 = 179.36$), before costs. That would not pay for much work. The interesting number is Bing's, as the next section shows.

Most privacy engines borrow someone else's index

A search engine has two halves. The index is the catalogue of pages a crawler has fetched and stored. The ranking decides which of those pages to show for a query, in what order. An index of the whole web is enormously expensive to build, so most privacy engines buy access to one and wrap their own privacy promise around it.

Here is what each says about itself. These are the companies' own descriptions, not an audit.

DuckDuckGo says it runs its own crawler, DuckDuckBot, and many indexes, but that its traditional links and images come largely from Bing.³ Ecosia says its search results and related ads come from Microsoft Bing, Google and EUSP, a European index it built with Qwant, and that which provider you get depends on your country, your device and your cookie permissions.⁴ Brave says Brave Search runs on its own index, built from scratch.⁵ Kagi says its results come from its own web index and news index, plus anonymised calls to the major search providers and specialist sources, typically a dozen or so per query.⁶ Startpage is the other name you will hear often. Its site would not let me read its documentation, so I am not stating what it uses.

That changes what "optimising for privacy search" means. For DuckDuckGo, and partly for Ecosia, the question is simply whether Bing has your pages. Brave has its own crawler with an unusual rule: it does not announce a separate user agent, and it will not crawl a domain or page that Googlebot is not allowed to crawl.⁷ So Brave follows whatever your robots.txt file says to Google.

Read it from the top. The two questions are both about your robots.txt file, the plain text file at the root of a site that tells crawlers what they may fetch. Only when both answers are yes does the quality of the page get a say.

Worked example: the robots.txt rule that hid Shandon Paper from DuckDuckGo

Ciarán notices that his best guide, on choosing fountain pen ink, ranks well on Google and is nowhere on DuckDuckGo. He opens his robots.txt file. A developer added these lines a year ago to stop scrapers:

User-agent: Googlebot
Allow: /

User-agent: *
Disallow: /

Step one: Googlebot has its own group, which allows everything. So Google crawls the site, and because Brave follows the Googlebot rule, Brave can too.⁷

Step two: Bing's crawler, bingbot, has no group of its own. Bing has explained that bingbot obeys a group naming bingbot first, then msnbot, and otherwise the default group marked with an asterisk.⁸ The default group here says disallow everything. So bingbot fetches nothing.

Step three: DuckDuckGo's traditional links come largely from Bing.³ No Bing, no DuckDuckGo. Ecosia serves Bing results to some users and Google results to others,⁴ so Ciarán is visible there only some of the time.

The fix is one more group, placed above the default:

User-agent: bingbot
Allow: /

Then Ciarán imports his site into Bing Webmaster Tools from Google Search Console, which Bing lets you do without a second verification step,⁹ and submits his sitemap there. He also turns on IndexNow, a protocol that lets a site tell participating engines a page has changed, and which shares each submission with all of them, Bing included.¹⁰ The details are in my piece on IndexNow and crawl budget.

Fixing this rule was never about €180 a month. It also reopened the €702.24 of Bing traffic from the first example. In my experience this is the most common privacy search problem: not a ranking problem at all, just a door shut by accident.

What the privacy promise covers, and what it means for you

Each privacy engine makes a promise to the searcher. It is worth reading those promises closely, because they tell you what you, the site owner, will and will not get.

DuckDuckGo says it does not save or share your search or browsing history when you search with it, and that its search ads are based on the results page you are viewing, not on you as a person.¹¹ Brave says Brave Search does not profile you.⁵ Kagi says it is a paid service, funded by subscriptions, with no ads.¹² Ecosia's privacy page would not load for me, so I leave its promise to Ecosia.

Three things follow for a business.

There is no audience to buy. If an engine does not build a profile of the searcher, there is nothing to retarget and no "people interested in stationery" segment on that engine. On DuckDuckGo, by its own account, the ad matches the query, nothing more.¹¹

You do not get the query. This is true of nearly all search now, not just the privacy engines. When a visitor clicks from one site to another, the browser sends a Referer header, the address of the page they came from. The default policy in modern browsers, if a site sets none, sends only the origin for a cross site click, so https://duckduckgo.com/ and not the search terms.¹³ A site can also ask the browser to send nothing at all, the no-referrer policy,¹³ in which case the visit looks like someone typed your address.

The landing page becomes your best clue. You know where they arrived, so you know roughly what they wanted.

An example: a visitor reaches shandonpaper.example/guides/fountain-pen-ink, and Ciarán's server log records the referrer https://duckduckgo.com/. Ciarán cannot know whether they searched "best fountain pen ink" or "ink that does not bleed through paper". He can know three things: they came from DuckDuckGo, they wanted the ink guide, and whether they then bought anything. That is enough to judge the guide. It is not enough to judge a keyword, and on these engines it never will be.

Kagi is the one engine that says trackers cost you rankings

The old article claimed that privacy engines "often penalise sites with excessive trackers or aggressive advertising". Of the engines I checked, only one says anything like that about itself. Kagi's FAQ says: "We downrank web pages that contain ads and trackers."¹² Kagi also lets each user block, lower, raise or pin individual websites in their own results, and shows how many ads and trackers it detected on a site.¹⁴ DuckDuckGo, Brave and Ecosia make no such statement in the pages I read, so I have narrowed the claim to Kagi.

Kagi is too small to appear in StatCounter's Irish list,² so I would not rebuild a site to please it. But it points at something worth doing for every visitor: a third party script is a cost. It slows the page, it needs consent unless it is strictly necessary, and it sends your visitor's data to someone else.

Worked example: Ciarán's product page, script by script

Ciarán's ink product page loads nine third party scripts. We go through them one at a time and ask what each one does for him.

1. Analytics: used every week. Keep, behind a yes on the banner (the next sections explain why Ireland has no exception for it).
2. A reviews widget: shows real customer reviews. Keep.
3. The payment provider's script: needed for checkout. Keep.
4. A chat widget: two conversations in three months. Remove, put an email address on the page.
5. A session recording tool: nobody has opened it since it was installed. Remove.
6. A social media pixel: feeds a retargeting audience Ciarán stopped advertising to last spring. Remove.
7. A second social pixel, for a platform he has never advertised on. Remove.
8. An old affiliate tracking tag from a scheme that ended. Remove.
9. A web font loader: the brand font. Keep for now, and serve it from his own domain next.

Nine scripts become four. The page weight drops from 1.9 MB to 1.2 MB. The percentage change is:

$$\Delta\% = \frac{v_{\text{new}} - v_{\text{old}}}{v_{\text{old}}} \times 100$$

$\Delta\%$ is the percentage change, $v_{\text{new}}$ the page weight after the clean up, and $v_{\text{old}}$ the page weight before. See Foundations: percentages.

Step by step: $(1.2 - 1.9) / 1.9 = -0.368$, a fall of 36.8%. Kagi may or may not notice. Every visitor on a slow train out of Kent Station will. Why speed matters for ranking and for sales is covered in Core Web Vitals and user experience.

The bigger privacy shift happened in the browser

Search engines decide whether a visitor finds you. Browsers decide what you can know about that visitor once they arrive, and that is where privacy changed the most.

Safari has blocked third party cookies by default since March 2020.¹⁵ A third party cookie is one set by a domain other than the site you are on, the kind ad networks use to recognise a browser across sites. Firefox gives each website its own separate cookie storage, so a tracker's cookie cannot follow a visitor from site to site, and made this the default for all desktop users worldwide in 2022.¹⁶ Safari's Private Browsing also removes known tracking parameters from links and blocks known trackers.¹⁷ And since Safari 26, released in September 2025, Safari stops known fingerprinting scripts from reliably reading device details such as screen size and CPU cores, from setting long lived cookies or local storage, and from reading query parameters and the referrer.¹⁸ The Brave browser blocks third party ads and trackers and cross site cookies through its Shields.¹⁹

Chrome went the other way. Google dropped its plan to remove third party cookies and retired most of the technology meant to replace them, in announcements of July 2024, April 2025 and October 2025.²⁰²¹²² I walk through that timeline, and what it means for your own data, in merging first party data with SEO, so I will not repeat it here.

Worked example: how much of Ireland is browsing with cookie protection on by default

StatCounter's Irish browser figures for October 2026, which count page views on sites running its code, give Chrome 56.41%, Safari 30.69%, Edge 6.07%, Samsung Internet 3.59%, Firefox 1.58% and Opera 0.71%.²³

Safari blocks third party cookies by default and Firefox isolates them by default. The share of Irish page views in one of those two browsers is the sum of their shares:

$$s_{\text{protected}} = s_{\text{Safari}} + s_{\text{Firefox}}$$

$s_{\text{protected}}$ is the share of page views in a browser with third party cookie protection on by default, and $s_{\text{Safari}}$ and $s_{\text{Firefox}}$ are each browser's share. Adding shares of one whole is explained in Foundations: percentages.

Step by step: $30.69\% + 1.58\% = 32.27\%$. About a third of Irish page views, before a single visitor has clicked "reject" on a banner, and before counting anyone who has changed the settings in Chrome or installed a blocker. Compare that with the 1% of search referrals from the privacy engines. The privacy shift that matters to Ciarán is not where people search. It is what their browser lets him do once they arrive.

Irish law sets the floor, whatever the browser allows

Browsers decide what is technically possible. The law decides what is allowed, and in Ireland it has required consent for tracking cookies far longer than the browsers have blocked them.

The rule is regulation 5 of the ePrivacy Regulations 2011, S.I. No. 336 of 2011. Paragraph (3) says a person shall not use an electronic communications network to store information, or to gain access to information already stored, in the terminal equipment of a subscriber or user, unless the user has given consent and has been given clear and comprehensive information about the purposes.²⁴ Paragraph (5) holds the only two exceptions: storage or access solely to carry a communication, and storage or access strictly necessary for a service the visitor explicitly asked for.²⁴ There is no exception for statistics.

The regulator is the Data Protection Commission (DPC). Its guidance note on cookies says analytics cookies require consent, that cookies related to advertising are not strictly necessary and must be consented to, and that the rule covers pixels, local storage and fingerprinting as well as cookies.²⁵ It adds that first party analytics limited to aggregated statistics, with clear information and an easy opt out, are unlikely to be a priority for enforcement, which lowers the risk without changing the rule.²⁵

Then there is the GDPR, which covers personal data itself. Its definition of personal data includes information that identifies someone indirectly through an online identifier.²⁶ That matters for the measurement in the next section, because server logs hold IP addresses.

I will not repeat the consent rules in full. The banner, the exceptions and what fires when are in cookies, consent and the ePrivacy mess, and the code side is in event tracking and consent mode.

An example: of Ciarán's four remaining scripts, the payment script is strictly necessary for a purchase the visitor asked for. The analytics waits for a yes, because regulation 5 has no statistics exception and the DPC says analytics cookies need consent.²⁴²⁵ Had he kept the social pixels, they would have needed consent too, because advertising is never strictly necessary.²⁵

Measure the privacy engines from your own server

If you want to know what DuckDuckGo or Brave Search actually send you, your analytics tool is the wrong place to look first. It only sees visitors whose browser runs its script and who allowed it to. Your web server sees every request.

The method is plain. Take one month of server access logs. Keep only requests for HTML pages, not images or scripts, and drop known bots. Group the rest by the origin in the Referer header. Then compare each engine's count with what your analytics reports for the same engine and the same month.

Do this with care. Under the GDPR an IP address in a log can be personal data.²⁶ In the shops I have worked on, I keep the aggregated counts and let the raw logs expire after a short, stated period.

Worked example: Shandon Paper's October, logs against analytics

Ciarán's server logs for October show page requests with these referrer origins: Google 18,100, Bing 1,340, DuckDuckGo 150, Ecosia 60 and Brave Search 45. His analytics shows sessions from the same engines: Google 11,000, Bing 780, DuckDuckGo 40, Ecosia 18 and Brave Search 10.

The share of each engine's visits his analytics can see is a simple ratio:

$$v_e = \frac{a_e}{l_e}$$

$v_e$ is the visible share for engine $e$, $a_e$ the sessions analytics recorded from it, and $l_e$ the page requests the server logged from it. A ratio of events to opportunities is in Foundations: ratios and rates.

Step by step: Google $11{,}000 / 18{,}100 = 0.61$. Bing $780 / 1{,}340 = 0.58$. DuckDuckGo $40 / 150 = 0.27$. Ecosia $18 / 60 = 0.30$. Brave Search $10 / 45 = 0.22$.

The horizontal axis shows the five engines in Ciarán's logs. The vertical axis is the share of each engine's logged visits that his analytics also recorded. The takeaway: analytics sees about six in 10 of Ciarán's Google visitors, but only around a quarter of those from the privacy engines. Some of that is consent and some is blocking, and Ciarán cannot split the two. Two cautions before he acts on it. A page request and a session are not exactly the same thing, so the ratios are rough. And 45 visits from Brave Search is a small number, so next month could easily look different.

What it tells him is still useful. If he judged DuckDuckGo by analytics alone, he would think it sends 40 visitors a month. His server says 150. For any channel whose users protect their privacy, your own logs, and your own order database, are the honest count. Pairing them is covered in server side tracking.

Honest pages are the real optimisation

The old article's best instinct was this one: write and design for people who dislike being manipulated. I keep it, minus the claim that privacy minded users are measurably more loyal, which I could not source. The case does not need it. A page without false urgency, pre ticked boxes or a pop up that ambushes the reader is a better page for everyone, and in Ireland, as across the EU, several of those tricks are also a legal problem. The legal side is in GDPR dark patterns.

In practice that means four things. Headlines that say what the page delivers. An answer to the searcher's question before any offer. Consent asked for plainly, with no as an equal choice. And fewer scripts, as in the product page example.

Worked example: the pop up Ciarán switched off

Ciarán's site showed a newsletter pop up three seconds into every first visit. Over three months it collected 260 sign ups from 20,000 first visits, and 30% of those people unsubscribed within 90 days.

He replaces it with a plain offer at the end of each guide: a printable ink comparison chart by email, with the newsletter as a separate unticked box. Over the next three months, with the same 20,000 first visits, it collects 210 sign ups, and 12% unsubscribe within 90 days.

The subscribers still there after 90 days are:

$$k = n \times (1 - u)$$

$k$ is the number of subscribers kept, $n$ the number who signed up, and $u$ the share who unsubscribed within 90 days, as a decimal. Working with a share and its complement is in Foundations: percentages.

Step by step: with the pop up, $260 \times (1 - 0.30) = 182$. With the offer at the end of the guide, $210 \times (1 - 0.12) = 184.8$, so about 185.

Fewer sign ups, the same number of people who actually want to hear from him, and no visitor ambushed on arrival. That is the trade I would make every time. These figures are invented, so treat them as the method, not a promise: run the same comparison on your own numbers before you decide.

What I would do, in order

If Ciarán asked me where to start, this is the order.

1. Read robots.txt and make sure both Googlebot and bingbot can reach every page you want found. That one file decides Google, Bing, most of DuckDuckGo, part of Ecosia and Brave Search.³⁴⁷⁸
2. Import the site into Bing Webmaster Tools from Search Console, submit the sitemap, and turn on IndexNow.⁹¹⁰
3. Count search referrals from your server logs once a month, by engine, and keep only the aggregates.²⁶
4. Strip every third party script that no longer earns its place, and put everything that is not strictly necessary behind a yes.²⁴²⁵
5. Write pages that answer first and offer second, with consent as a plain, separate choice.
6. Only then think about the privacy engines as a channel of their own. For most Irish shops I see, they are a rounding error in revenue and a useful reminder of what every visitor now expects.

Privacy driven search, in the end, is less about a handful of small engines than about a web where a third of page views happen in browsers that block tracking by default, the law asks first, and visitors can tell when a page respects them. Optimise for that, and the privacy engines come along for free.

Sources

Footnotes

1. StatCounter Global Stats, FAQ (search engine referrals and network size), StatCounter, https://gs.statcounter.com/faq

2. StatCounter Global Stats, Search engine market share Ireland, October 2026, StatCounter, 2026, https://gs.statcounter.com/search-engine-market-share/all/ireland

3. DuckDuckGo, Where do DuckDuckGo search results come from?, DuckDuckGo Help Pages, https://duckduckgo.com/duckduckgo-help-pages/results/sources

4. Ecosia, Search result providers, Ecosia Help Center, updated 12 August 2026, https://support.ecosia.org/article/579-search-results-providers

5. Brave, Brave Search, Brave Software, https://brave.com/search/

6. Kagi, Search sources, Kagi Help Center, https://help.kagi.com/kagi/search-details/search-sources.html

7. Brave, Brave Search Crawler, Brave Search Help, https://search.brave.com/help/brave-search-crawler

8. Bing Webmaster Team, To crawl or not to crawl, that is BingBot's question, Bing Blogs, 3 May 2012, https://blogs.bing.com/webmaster/2012/05/03/to-crawl-or-not-to-crawl-that-is-bingbots-question/

9. Bing Webmaster Tools team, Easily verify your site in Bing Webmaster Tools by importing from Google Search Console, Bing Blogs, 13 September 2019, updated June 2025, https://blogs.bing.com/webmaster/september-2019/Import-sites-from-Search-Console-to-Bing-Webmaster-Tools

10. IndexNow, FAQ, indexnow.org, https://www.indexnow.org/faq

11. DuckDuckGo, Privacy Policy, DuckDuckGo, https://duckduckgo.com/privacy

12. Kagi, FAQ, Kagi Help Center, https://help.kagi.com/kagi/faq/faq.html

13. MDN Web Docs, Referrer-Policy header, Mozilla, https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy

14. Kagi, Website info and personalised results, Kagi Help Center, https://help.kagi.com/kagi/features/website-info-personalized-results.html

15. John Wilander, Full Third Party Cookie Blocking and More, WebKit, 24 March 2020, https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/

16. Mozilla, Firefox rolls out Total Cookie Protection by default to more users worldwide, The Mozilla Blog, 14 June 2022, https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/

17. WebKit, Private Browsing 2.0, WebKit, 16 July 2024, https://webkit.org/blog/15697/private-browsing-2-0/

18. WebKit, WebKit Features in Safari 26.0, WebKit, 15 September 2025, https://webkit.org/blog/17333/webkit-features-in-safari-26-0/

19. Brave, Brave Shields, Brave Software, https://brave.com/shields/

20. Anthony Chavez, A new path for Privacy Sandbox on the web, Google Privacy Sandbox, 22 July 2024, https://privacysandbox.google.com/blog/privacy-sandbox-update

21. Anthony Chavez, Next steps for Privacy Sandbox and tracking protections in Chrome, Google Privacy Sandbox, 22 April 2025, https://privacysandbox.google.com/blog/privacy-sandbox-next-steps

22. Anthony Chavez, Update on plans for Privacy Sandbox technologies, Google Privacy Sandbox, 17 October 2025, https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies

23. StatCounter Global Stats, Browser market share Ireland, October 2026, StatCounter, 2026, https://gs.statcounter.com/browser-market-share/all/ireland

24. European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, regulation 5, Irish Statute Book, 2011, https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print

25. Data Protection Commission, Guidance note on cookies and other tracking technologies, DPC, April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf

26. Regulation (EU) 2016/679, General Data Protection Regulation, Article 4(1), EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679