Luke Mulks [VP Business Ops, Brave] - Build User First @ Ethereum Cypherpunk Congress

Hi everybody. I'm Luke Mols, a VP of business operations at Brave and at the basic attention token. And today I'm here to talk about building user first, addressing privacy concerns in a more privacy aware world. We're here, it's 2025, privacy finally hit the timeline, which is fantastic. Um, we're seeing the pickup of cash and uh Zcash and rail gun.

Um, you know, on the crypto side and a whole new slew of ZK related uh protocols and teams and projects um which is fantastic. uh you know we're seeing a proliferation of AI tools. Chat GBD is becoming a verb. Sam Alman is going out to Ovana and talking about how uh you know with people uh you know treating CHBT like their therapist, lawyer and doctor um reminding people that hey uh you know if those records can be um uh requested they will be provided. Um so there's a new level of privacy concerns around AI that were not there before.

Uh also with the passing of the Genius Act and stable coin adoption, um the EU's talking about CBDC's and that's creating a new uh awareness around financial privacy that wasn't necessarily there before. At the same time that you have the UK, EU and Florida and Texas implementing uh ID verification methods in certain contexts or in order to KYC with the web as a whole. Um and um you know at the same time like on a positive note starting to see privacy oriented products gaining momentum um you know protons you know at 50 to 100 million uh users. Braves uh we we've reached over 100 million monthly active users. Um so you know having the numbers it helps to put the um you know the the the data to uh you know the um the need for privacy.

Uh and what does this mean? So shift of awareness with privacy. Um we went from an era in 2016 where uh people that supported the status quo um said hey people don't care about privacy. They raised doubt around how much uh users care the privacy paradox. Hey all the kids are putting their lives on social why privacy is dead.

That kind of thing. Uh it turns out that when products do um make privacy convenient and competitive uh that people do move uh to they will they do care. or they will move with their feet to a product that protects their privacy um when they is a product is available to protect their privacy and and where does that put us? So so now in 2025 we find ourselves in a place where the markets going from doubting whether privacy matters to having to compete with privacy. So what we're going to start seeing is you know companies saying we have a privacy thing and we also have a privacy thing.

Oh we've solved for privacy in other marketing uh frankly. Um but also you'll start to see a redefinition of oh confidential as a new privacy or or you'll start to see solutions that uh focus on privacy for some or privacy for some some of the time or privacy for all some of the time or privacy in certain context. These aren't necessarily inherently bad things but they are uh they are things that we should be aware of. Um and so for for devs and builders uh it's really time to step up. Um, I can't uh say this strongly enough.

Uh, you know, privacy changes at scale do not happen from the ground up. They happen because people build things that put people's privacy uh in the in the the spotlight and uh and protect it. Uh so, you know, without without solutions that include privacy, users have nowhere to go. And also, it means you got to realize that privacy is not a layer, pool, rail or a single vector to solve for. Um privacy is a mindset that you have to adopt as an organization at your core at your ethos.

Um from your policies to your product implementation to how you dictate uh you know your relationship with the users and that's why your policies are as important uh for privacy as your implementation is. Um your policies are telling the world what your company can do and will do uh with the user's information even if you're not doing it today. um it's kind of the the upper and lower bound the range that that of things that can happen and who that data can be shared with. So it's important that your policies reflect what you're putting in the product. So if you b build from first principles on both um that reflect an ethos around privacy, you're going to be able to see something that's much more holistic.

Um but but really it's not about priv it's about building user first. Um user first isn't new, but it's arguably long forgotten. uh uh you know building a user first ethos protects the user's privacy by default but it also does other things like bring security incentive benefits for the user uh that in addition to privacy and that's really important because you look out for the user on all fronts. Um crypto has the opportunity to uh either lead by example uh with user first principles or build an even more dystopian future by ignoring them. Uh and we'll get more into that a little bit later.

Um, building user first is possible. At Brave, we've built from from zero to 100 million monthly active users uh uh with user first principles. We've also built business with this with you know Ford, Toyota, major advertisers, major agencies putting their business through Brave uh that preserves privacy for users. Um we've we've grown uh revenue to over 100 million uh annually uh using for user first principles. This stuff is possible.

It's not just us either. Proton and others have embraced user first principles and have made businesses that respect those principles and and and respect the users. Um ultimately we are all users. If you want a future that's better on privacy, you have to build the future that you hope others will build for you. Said the example.

Um what is user first? User first simply means putting the interest of the user first before company's commercial interests. putting user first with your policy decisions and terms, with your partnerships, commercial integrations, with the way you handle privacy and data handling, with how you manage the relationship with the user. Are you putting the interests of a partner of another business ahead of the user because they want you to sacrifice something from the user or are you saying no, the user's paramount. We will protect the privacy of the user.

We will not whitelist your thing that collects the user's information without them knowing it. the user is first. Uh building user first brings practical challenges. Uh you know the current defaults at scale uh with the web uh the defaults that power and monetize the web are inherently user hostile. This isn't necessarily malicious.

This is the way that big tech scaled. Um there's this notion that in order to have a quote unquote free web that requires the user sacrificing their privacy as a cost. It is it is fundamentally broken and it is something that we're all trying to correct in this room. Um, you know, it means you're going to have to work against the grain with large things you do and with small things that you do with accounting and with uh with performance. It means you have to look and do the hard work of saying what do I need to know and what can I get rid of?

Um, it requires discipline to do this. Uh, it's going to impact your partnerships and commercial considerations. It means doing more diligence with those things and it means saying, "Hey, I'm not going to sacrifice my user privacy by whitelisting something or hey, I'm not just going to glaze over policies and hope that you're doing the best." Uh, people don't know what privacy merely means. Companies really don't know either.

Uh, in the EU, they've set personal def they've set definitions around what personal data and information means. But in the US, it's basically privacy is basically what companies say that it is. Um, you know, in a world of privacy awareness, there are going to be many shades of privacy lipstick that emerge from the pigs in tech. And so what it really means is that it's on us as builders to basically do the diligence, do our homework, and double check and make sure that the policies, the implementation, and the practices align with what we're putting in front of our users and putting our users into. So don't treat privacy as a one-off feature, an isolated vector, or a thing to solve with a single item solution.

treat it as a holistic mindset, treat it as an ethos that you implement at every level of the company. Um, if we don't objectively audit our current state of the products and policies, then we're just building a more dystopian future. If you're using uh web two data analytics uh that pass information uh on what the user is doing in the URL, you're most likely unintentionally passing what they're doing in web 3 along with uh that information. Um, this be makes a more dystopian feature. um for the users.

It makes a richer target for marketers. It makes a richer target for governments. Um aim to collect a little as little or no user information as possible. And finally, like create a p privacy and security review process. Um we have a great one.

You can steal it. The link's on the screen. Uh make this a thing that you do. Uh and and take a closer look into that and ask others to do it as well. [gasps] Finally, like if you're using Google Analytics or Google Tag Manager, find a way to get rid of it.

like figure out what you can do that avoids using it. Um there are firstparty self-hosted solutions like Mtomo that let you condition and harden for privacy that you can use. There are great people over there. They got good documentation. Other people use it as well.

Feel free to reach out. Um you know also uh if you have to use dependencies that require data um you know opt to process and dump versus collecting it. If you have to collect it for some reason, collect it for as short as you can as possible and try to blind yourselves as a company from that by using client side encryption and other things like that. Um, never assume your partners or vendors are doing what they claim. Uh, period.

Look at their policies. Ask hard questions. Check the network traffic yourself. Like, you know, do the diligence. It's important if you care about the user and then ask them really dumb and really hard questions.

Um, they should be able to answer them if they're going to do business with you. Um, you know, web 3 users are at a significantly greater profiling and tracking risk because of two things. The culture that we're in, uh, where, you know, using crypto Twitter, attaching your social handle to a wallet address, putting them into a DAP that might be using web two analytics to collect all that information. Um, you know, you've got public transactions on a public blockchain along with public social profiles tied to a blockchain wallet and the web 2 status quo. Uh it's a recipe for a richer targeting set and for a more dystopian future.

Um so feel free to reach out to projects that do this right way. Like uh more than likely they're willing to talk with you. Uh I love it. I would rather compete with privacy preserving companies than ones that are privacy hostile. It forces us to build better products.

Um it's also builds a better world for everybody. Um and it's also more much easier to start with user first ethos and approach than to apply it retroactively. though it is possible. You just have to do a little bit more elbow grease and diligence on making the changes and stick with them. Finally, uh there is no freedom without privacy.

Um you know, a lot of companies in the crypto space and projects are going to say freedom a lot. Um check their policies. If they are behaving in a way that's user hostile, it's not really about freedom. It's about marketing. Um right now is our last chance to get it right.

And it's up to everybody in this room, everybody that's building to either change the game or capitulate to the status quo and to a dystopian future. AI is going to be bigger every day. It's going to converge with crypto. It's going to converge with web 2. This is our last chance to get it right.

So, I hope this was helpful. Uh, please, uh, thank you for your time. Uh, you know, if you want to check out more about Brave, go to brave.com. We're at Brave and attention token onx.

We're at github.com/brave. All our repos are out there. Our wiki is available in the Brave browser uh repo. Also, my DMs are open on X.

It's Luke Muls. Um I also host a Brave Technologist podcast. So, brave.commpodcast if you want to check it out. Uh feel free to reach out.

Thank you very much. Hope you have a great rest of the event.