My point is that "they're not an ad agency" is not an argument that a company has some incentive to protect user privacy, and "they're an ad agency" is not an argument that a company is incentivized to sell user data.

Yeah, okay, DDG _might_ be lying about their privacy promises. They _might_ be tracking us all ways to Sunday the way Google and Facebook do. They _might_ have some seekrit, back-door ad sales department that nobody knows about and somehow they've managed to keep secret. Which, of course, is a great method for making ad sales.

What does incentivise them is that their entire marketing is based around the privacy messaging, and thus pretty much their entire userbase considers that their primary selling point. If it ever came out that they were handing over that data to whomever, they'd be gone in an instant.