Another syndication partner of Microsoft is far more transparent in their privacy policy than Duck: "Bing: IP address (obfuscated), user agent string, search term, and some settings like your country and language setting. We never communicate IP addresses along with search queries. We only send IP addresses to Microsoft in obfuscated form, meaning we remove parts of the IP address when we sent it."
> It doesn't matter.
> Why? Because when going through the exercise of identifying risks in the system one can't assume the actors are benevolent and won't ever use the access+data they have for evil.
Storing any data in database is just asking someone to either steal it or abuse it. So only solution is to not store it, if it's not critical for operation. And if it's critical, store privacy data in encrypted form(and keep decryption keys away from database, so database breach won't jeopardize keys, like in different business unit in corporation). One such example is logs, store some of the data encrypted, and if you need it(with a really good reason) ask it to be decrypted. Also you can encrypt various forms of data with different keys, and make accessing one type easier while more privacy critical data will be harder to get access to.
Better to just have 1 Google service you use and find someone else for the others. Their search index is a little better than DDG's I think, but the difference is pretty small compared to the risks you outline and the risk of Google going rogue and deciding I'm a Russian or committed some other similar crime & need to be booted from their services.
It doesn't matter.
Why? Because when going through the exercise of identifying risks in the system one can't assume the actors are benevolent and won't ever use the access+data they have for evil.
That's not at all to say all actors are evil and will always do the most harm possible. Many risks are never exploited in practice. But that doesn't mean the risk doesn't exist. It still does! And it might be exploited in the future (with companies, all it takes is a reorg that puts someone less ethical in charge).
Thus, when doing your threat modeling exercise, for the purposes of identifying risk, assume the various actors could do as much damage as they possibly could with the access they have.
So concretely, when I evaluate risk on google vs. DDG: I won't take into consideration any "privacy respecting" marketing, that's not important. What matters is how much damage can each party do, which one is less risky?
Both get my search queries which is inevitable for a search engine. So there's that risk but it's a wash.
But google has its tendrils woven into far more points from which they can and will correlate data. Google analytics, AMP, gmail/gsuite, chrome (for people using that), also most people have an active login session with google most of the time, etc.
DDG has a much smaller footprint on the internet from which to correlate data.
Therefore, even assuming both parties are equally evil, DDG presents a smaller risk.