Following, by a day, a privacy-related claim challenge brought against another advertiser, the National Advertising Division found that advertiser DuckDuckGo had sufficiently substantiated its privacy claims. These cases are significant reminders in two ways. First, that claims made about privacy and security can be viewed through an advertising lens and examined to see if they are properly substantiated. Second, that the NAD, the self-regulatory body that actively examines truth and accuracy of advertising, is looking at privacy claims. As those familiar with the NAD are aware, it refers those who do not cooperate to the FTC for priority action to examine if there have been violations of Section 5 of the FTC Act.

DuckDuckGo provides a browser and mobile app search engine. In a promotional YouTube video, it claimed that using its products were the “best, quickest and easiest steps you can take for your privacy health.” The NAD assessed these and similar claims to understand how they would be perceived by consumers. It found that they conveyed that the company’s products were a way to protect against the sharing of individuals’ data. There was also an implied claim that the company did not share personal data.

The NAD found the claims supported by the evidence which included a third-party expert confirming that the company’s measures (encryption, tracker blocking, and private searches) protect against the three largest categories of personal data collectors. Additionally, the NAD found evidence that no special configurations to receive privacy protections were needed (unlike the company’s competitors) – support “best” claims. DuckDuckGo confirmed -through proof of regular audits and implementation of blocking technologies in its products- that it did not share personal data.

In reaching its conclusions, the NAD did caution DuckDuckGo to take care not to imply that its protections extended to search engines or apps that fell outside of its platforms’ solutions. Namely, through claims that one would be protected “no matter where the internet takes you.”

Putting It Into Practice: This case is another reminder that privacy representations may be examined through an advertising lens. Companies should take care to ensure that they have substantiation that supports both the express and implied claims that they make about how they use personal data.