A researcher has discovered that DuckDuckGo’s privacy-centric browser enables third-party tracking scripts from Microsoft Corp. to load in some cases.

The discovery was reported by Bleeping Computer on Tuesday. DuckDuckGo confirmed the findings in a statement, adding that it expects “to be doing more soon” about the third-party tracking scripts.

DuckDuckGo, incorporated as Duck Duck Go Inc., is a Pennsylvania-based startup backed by more than $170 million in funding. The startup operates a popular privacy-centric search engine that doesn’t collect user data for advertising purposes. DuckDuckGo also offers a browser that prevents websites from tracking users. 

DuckDuckGo’s browser is available on iOS, Android and Mac. It blocks third-party cookies, small snippets of data that brands install on users’ computers to track their interests and deliver personalized ads. The browser also disables other tracking technologies that serve a similar role as third-party cookies. 

DuckDuckGo partners with Microsoft to deliver ads in its search engine. Earlier this week, security researcher Zach Edwards revealed that even though DuckDuckGo’s browser promises to block third-party tracking scripts on websites, it allows Bing and LinkedIn to use such tracking scripts.

“I tested the DuckDuckGo so-called private browser for both iOS and Android, yet *neither version* blocked data transfers to Microsoft’s Linkedin + Bing ads while viewing Facebook’s workplace[.]com homepage,” Edwards wrote in a tweet.

DuckDuckGo founder and Chief Executive Officer Gabriel Weinberg confirmed the findings. “For non-search tracker blocking (eg in our browser), we block most third-party trackers,” Weinberg  wrote on Twitter. “Unfortunately our Microsoft search syndication agreement prevents us from doing more to Microsoft-owned properties. However, we have been continually pushing and expect to be doing more soon.”

In a statement to Bleeping Computer, the CEO said that DuckDuckGo’s browser does take some steps to limit the third-party tracking scripts used by Bing and LinkedIn. “What we’re talking about here is an above-and-beyond protection that most browsers don’t even attempt to do — that is, blocking third-party tracking scripts before they load on 3rd party websites,” Weinberg stated.

Last June, DuckDuckGo disclosed that its apps were downloaded more than 50 million times over the preceding 12 months. The company estimated at the time that its search engine has between 70 million and 100 million users.

DuckDuckGo generates revenue from ads, including search engine ads delivered through Microsoft’s online advertising platform. The startup says that Microsoft “does not associate your ad-click behavior with a user profile” when consumers click on an ad, which improves privacy. DuckDuckGo reported it generated more than $100 million in annual revenue as of last June.

Image: DuckDuckGo