about.qwant.com — 72/100 (Medium privacy risk)
Last analyzed
Qwant · qwant.com
Report details
Medium privacy riskQwant offers strong privacy by default without tracking cookies, but creating an account or consenting to cookies shares significant data with Microsoft, and the policy lacks clarity on international transfers and AI training.
Qwant's privacy policy presents a dual model: a highly privacy-friendly default experience that avoids tracking cookies and uses salted hashes for IPs, and a consent/account-based experience that shares full IP addresses, search keywords, and browsing data with Microsoft for personalized ads and AI features. While the default state is excellent for privacy, the extensive data sharing with Microsoft and the lack of transparency regarding international data transfers and AI model training create compliance gaps and risks for users who opt-in.
Category Assessment
Breakdown of the policy across key compliance areas. Good = strong, fair = mixed, poor = concerning.
Default mode minimizes data well using salted hashes, but creating an account or consenting triggers full IP and keyword transmission to Microsoft.
Detailed tables are provided, but the dual-mode nature (consent vs. non-consent) makes it complex, and key details on AI and transfers are missing.
Microsoft is deeply integrated for search, ads, and AI features, receiving significant data if consented or logged in, though Shadow and Batch have limited scopes.
The policy is silent on whether data shared with US-based Microsoft is transferred outside the EU or what legal safeguards are in place.
Mentions AI features but is completely silent on whether user data is used to train or improve these AI models.
Clearly lists standard GDPR rights (access, rectification, erasure, objection, portability) and provides direct contact details for the DPO and CNIL.
Key Findings
Notable clauses, issues, or positive practices discovered (critical first)
Lack of Transparency on International Transfers
While the policy notes one specific data flow to Microsoft remains 'within the European Union,' it does not disclose whether other data shared with Microsoft is transferred to the US or other third countries, nor does it mention transfer mechanisms like SCCs.
Extensive Microsoft Data Sharing
If a user creates an account or consents to cookies, Qwant shares full IP addresses, search keywords, and browsing data with Microsoft for personalized advertising, ad measurement, and new AI features.
Ambiguity on AI Data Usage
The policy mentions 'new features integrating artificial intelligence' but fails to specify whether user queries or data are used to train AI models, which is a critical transparency gap under GDPR.
Strong Privacy by Default
The policy explicitly guarantees that without consent or an account, Qwant does not use advertising cookies, store search history, or engage in targeted advertising, relying instead on salted hashes of IP addresses.
Retention Period Complexities
Retention periods are fragmented: Microsoft retains cookie identifiers for 18 months, Qwant retains aggregated data for 25 months, and keywords are dissociated from identifiers after 1 month but kept for 12 months, making it hard for users to understand how long their data exists.
Consumer Takeaway
You can use Qwant with strong privacy protections if you avoid creating an account and reject cookies; however, using their new AI features or accepting cookies opens the door to significant tracking by Microsoft.
Compliance Posture
The policy aligns with GDPR principles by offering a privacy-by-default setting and clear consent mechanisms for cookies. However, it fails the GDPR's transparency requirement regarding international data transfers (Article 44) and potentially regarding the specific purposes of AI data processing (Article 5(1)(b)).
EU Transfers
The policy explicitly states that one specific data transmission to Microsoft occurs 'within the European Union,' but it is entirely silent on whether other data shared with Microsoft (a US-based company) is transferred outside the EEA, nor does it mention appropriate safeguards like Standard Contractual Clauses.
Detected Signals
Specific data points and practices identified in the text
Evidence Snippets
Direct quotes from the policy supporting these findings
Qwant remains your search engine, preserving your privacy without targeted advertising or storing your search history, thus guaranteeing neutral and unfiltered results without using advertising cookies on your Device.
Qwant may also collect and transfer your full IP address to this partner [Microsoft]. Finally, as part of providing new features, Qwant shares your IP address with Microsoft to provide you with contextual ads and better search results.
This data is transmitted to this partner within the European Union and may be retained in accordance with Microsoft’s Privacy Policy for a maximum period of 18 months.
Qwant also gives you the opportunity to test our new features integrating artificial intelligence once a month. Details on the processing of your data are available in the 'Non-Consent' processing table.
Salted hash of the IP address (with a salt changing at least every three months), market segment of a query, date and time of the visit, information about the country and chosen language.
Missing or Unclear
- No disclosure of international transfer mechanisms (e.g., Standard Contractual Clauses) for Microsoft data
- No information on whether user data is used for AI model training
- No details on the specific 'random token' shared with Microsoft and its privacy implications
- No mention of Data Protection Impact Assessment (DPIA) for AI features
Questions to Ask
- Are any personal data transfers to Microsoft subject to EU-US data transfers, and if so, what legal mechanism (e.g., Standard Contractual Clauses, Data Privacy Framework) is relied upon?
- Is user data, such as search queries or IP addresses, used to train Qwant's or Microsoft's artificial intelligence models?
- What specific 'random token generated by Qwant' is shared with Microsoft, and how does it technically prevent cross-referencing across different sessions or services?
- Has a Data Protection Impact Assessment (DPIA) been conducted for the new AI features that require IP address sharing?
Share this analysis
Anyone with this link can view the result above.
Built by DentroChat
100% European AI chat for everyone
Chat with AI, work with files, generate images, and search the web. Data stays in Europe.
Other analysed privacy policies
View allapple.com
72/100
Medium privacy riskApple's Messages privacy disclosure shows strong encryption and short data retention but leaves critical EU compliance gaps—no mention of international transfers, GDPR user rights, or whether message metadata trains AI models.
View report →signal.org
72/100
Medium privacy riskSignal genuinely collects almost nothing and encrypts everything, but its legal documentation is outdated and missing critical GDPR-mandated disclosures like transfer safeguards, retention periods, and user rights procedures.
View report →slack.com
72/100
Medium privacy riskSlack collects a wide range of personal and usage data, relying heavily on broad legitimate interests to process it and transfer it globally, though it does provide standard GDPR rights and safeguards like Standard Contractual Clauses.
View report →robotstxt.es
68/100
Medium privacy riskRobotstxt generally respects EU privacy but lacks clear details on legal bases, third‑party processors and AI use.
View report →