DuckDuckGo Browser
What the default settings do
The DuckDuckGo browser (available on iOS, Android, and as standalone desktop apps for Mac and Windows) is built around privacy as the default rather than an opt-in feature. Third-party tracker loading is blocked automatically, Global Privacy Control is sent on every request without needing to be turned on, and cookie pop-up handling and link-tracking protection are already active the moment you install it. This guide is shorter than most in this collection for that reason: there just isn’t a long list of defaults to walk back.
It’s worth addressing the browser’s most cited criticism directly rather than skipping past it. In May 2022, a researcher found that DuckDuckGo’s tracker blocking carved out an exception for Microsoft scripts on third-party sites, a result of a search-syndication agreement with Microsoft. After public criticism, DuckDuckGo renegotiated that agreement and removed the exception in August 2022; Microsoft tracking scripts have been blocked the same as Google’s, Facebook’s, and everyone else’s since then, across the iOS and Android apps, the desktop browsers, and the browser extensions. It is a fair thing to have been skeptical about at the time, and a fair thing to consider resolved now.
A reasonable privacy baseline
These settings live in the app’s Settings menu (the three-dot or hamburger icon), with minor differences between the mobile apps and the Mac/Windows desktop browsers.
App Tracking Protection (Android)
Settings → More from DuckDuckGo → App Tracking Protection → On
This is the one feature here that genuinely extends beyond the browser: it uses a local, on-device VPN connection (no data leaves your phone) to detect when other apps try to send data to known third-party trackers, and blocks most of those requests. It covers your other installed apps, not just DuckDuckGo itself, and it is off until you turn it on. If it causes a specific app to misbehave, you can exempt that app individually rather than disabling protection entirely.
Global Privacy Control
Settings → Global Privacy Control (GPC) → Confirm On (already on by default)
GPC sends a signal to every site you visit that you do not want your data sold or shared, which is legally enforceable in a growing number of US states. DuckDuckGo turns this on for you automatically, so there's nothing to change, just worth knowing it's there and confirming it hasn't been switched off.
Fire Button and site data
Settings → Automatically clear tabs and data → Consider On on a shared or borrowed device
The Fire Button (and this related auto-clear setting) erases cookies, site caches, open tabs, and granted permissions like camera or location access. It does not clear bookmarks, downloaded files, or sites you've marked as Fireproof. Turning on automatic clearing means every relaunch starts fresh; leaving it off and using the Fire Button manually gives you more control over when that happens.
Fireproof Sites → Add sites where you want to stay signed in
Fireproofing a site exempts its cookies and local storage from the Fire Button and auto-clear, so you don't get logged out of your email or banking site every time you clear data elsewhere.
Email Protection
Settings → Email Protection → Sign up and use a Duck Address for new sign-ups
Email Protection gives you a personal @duck.com forwarding address that strips tracking pixels and known tracking parameters from incoming mail before forwarding it to your real inbox, and tells you how many trackers it removed. DuckDuckGo does not store the forwarded email itself. This is opt-in and worth turning on before your next account sign-up rather than something that happens automatically.
Duck.ai
Duck.ai → Sync & Backup → Leave off unless you specifically need chat history across devices
DuckDuckGo strips personally identifying metadata, including your IP address, before sending prompts to the underlying model providers (currently including Anthropic, OpenAI, and others), and contractually restricts those providers from using the data to train their models or retaining it beyond what's needed to generate a response. Sync & Backup is an optional feature that keeps chat history across your devices and auto-deletes it after 18 months of inactivity; leaving it off means conversations aren't retained across sessions at all, which is the more private default of the two options.
Analytics and diagnostics
Settings → Analytics & Improvements (or similarly named diagnostics section) → Off
The apps send anonymized usage and crash data that DuckDuckGo says is not linked to you personally, intended to catch bugs and understand feature usage rather than to profile you. The exact label and location of this toggle varies somewhat between the iOS, Android, Mac, and Windows apps and between versions, so if "Analytics & Improvements" isn't where you find it, look for anything referencing usage data, diagnostics, or crash reporting in Settings.
Trade-offs
- Turning on automatic tab and data clearing means you’ll be logged out of sites each session unless you add them as Fireproof exceptions.
- App Tracking Protection uses a local VPN slot on your device, which means you can’t run a separate always-on VPN app at the same time; you’ll need to choose one or the other, or check whether your VPN provider supports running alongside it.
- Skipping Sync & Backup for Duck.ai means chat history won’t follow you to a second device, and closing the app may lose an in-progress conversation depending on the platform.
- Opting out of analytics and crash reporting means DuckDuckGo has less signal to catch bugs specific to your device or app version.
Who should not change these settings
- If you already run a separate always-on VPN, you may need to skip App Tracking Protection or test whether your VPN app tolerates a second local VPN connection, since Android only allows one active at a time.
- If you use Duck.ai across a phone and a laptop and want continuity between them, Sync & Backup is a reasonable trade for that convenience, your chats are still anonymized before reaching the model provider either way.
- If you’re comfortable with DuckDuckGo’s anonymized-analytics approach and want to help catch bugs, leaving Analytics & Improvements on is a fine choice; it’s a considerably smaller data footprint than default telemetry in most other browsers.
- If you previously avoided DuckDuckGo specifically over the 2022 Microsoft tracker exception, that carve-out has been removed since August 2022 and Microsoft scripts are blocked the same as any other third-party tracker today.