There are two separate issues: the commercial exploitation of personal data, and state surveillance. My understanding is, that while the US has virtually no st

There are two separate issues: the commercial exploitation of personal data, and state surveillance. My understanding is, that while the US has virtually no statutory protection of privacy, DDG has a privacy policy, and deliberately violating it would be fraudulent, contravene COPPA, and make them liable in tort law. As far as state surveillance goes, the EU is not a haven, the UK, despite being a member, is one of the worst offenders. Some European countries have relatively good surveillance laws, such as Iceland and Switzerland (neither being in the European Union).