Brave browser is collecting donations on your behalf — did you know?

Quick Take

  • Brave allows its users to send publishers BAT tokens, but most publishers don’t know this fact
  • British YouTuber Tom Scott was not happy to learn that Brave was collecting funds on his behalf
  • Scott wants Brave to refund all the tokens, but the tips are anonymous
  • Brendan Eich, Brave’s founder, says Brave has updated its reward system in response, but there is still no opt-in feature
  • After raising $35 million in an ICO last year, Brave still controls 23% of the BAT supply

The Brave web browser is collecting money in the form of BAT (basic attention tokens) on your behalf! Surprise!

Free money doesn’t sound too bad. But the second part is an issue.

If you tell someone you are collecting money on my behalf, that means someone could send you money thinking it is actually going to me. But in reality, if you are keeping that money for yourself or using it for some other purpose, that could be construed as fraud.

When popular Youtube personality Tom Scott – who had never even heard of Brave – found out Brave was collecting money under his name, he was not happy about it.

Here is the tweet that tipped him off, sent to him on December 17.

What is Brave?

Brave is a boutique browser that removes ads and ad tracking from the browsing experience. It is based on Chromium, the open-source project that Google and others maintain. Some people like Brave because it is really fast. But it is fast primarily because it loads no ads… for the moment, at least. 

Eventually, Brave will introduce its own Brave-approved ads. As Computer World described it: “It’s as if a new TV network announced it would use technology to remove ads from other networks’ programs, then rebroadcast those programs with ads of its own devising, ads that it sold.”

Naturally, the media doesn’t like this idea.

“Your plan to use our content to sell your advertising is indistinguishable from a plan to steal our content to publish on your own website,” lawyers for 17 newspapers publishers wrote in a letter to Brave Software, the San Francisco-based company that develops Brave, in April 2016.

As a substitute for traditional ads on Brave, you can pay the sites that you visit with BAT, an Ethereum-based ERC20 token. You can set a monthly contribution amount, and Brave automatically distributes BAT tokens to the sites you visit based on your user attention. In other words, how much time you spend on each site.  

How do you get your hands on BAT? At some point when Brave is fully operational, you will be able to earn them by watching those Brave-approved ads. You can buy them on a third-party exchange—BAT is listed on several exchanges, including Coinbase—or Brave will give you BAT in the form of a grant.

It’s also possible you bought BAT in the project’s initial coin offering (ICO), but we’ll come back to that in a moment.  

Brave appeals only to a niche crowd. In the broader world of browsers, its user share is so small that analytics vendor Net Applications does not even list it.

Perhaps the real answer to “Why should anyone care about Brave?” is that Brave Software was co-founded by Brendan Eich.

Creator of the hugely popular JavaScript language, Eich is somewhat of a legend in the tech world. In 2014, he also served a short stint (11 days, to be exact) as the CEO of Mozilla, developer of the Firefox Web browser. He was pressured to step down over backlash for his support of California’s Proposition 8, a ballot measure to ban gay marriage in the state. His anti-gay stance conflicted with Mozilla’s ethos of promoting “openness, innovation and opportunity on the internet.”

Why is Scott upset?

Earlier this week, Brave rolled out a tipping banner feature for Brave publishers. This feature lets you tip the sites you visit in BAT tokens. You visit a site, and then when you click the “send tip now” button in the browser’s reward panel, a banner ad appears asking for your support.

The one for Scott looked very much like it came directly from Scott himself. It had a picture of his face and the word “Welcome” right beside it.

“I initially misunderstood what was happening, and assumed that someone had registered as me,” Scott told The Block in an email. Once he figured out what was going on, he emailed Brave asking them to stop and to refund any donations.

A spokesperson for Brave responded: “I’ll pass your sentiments onto the team and we’ll see what we can do. Refunds are impossible since our donation system is anonymous, but I’m going to see if we can get your channel blacklisted from the system.”

Scott, who lives in London, followed with another email asking a few questions, including what would happen if he sent a formal right-to-be-forgotten request under E.U.’s general data protection regulation (GDPR)?

Eich should have a clear understanding of these privacy laws. He is a huge supporter of GDPR. In September, he even wrote a letter to the U.S. Senate stating that we need something like GDPR here in the U.S.

When Scott did not get a response to his follow-up questions, he took to Twitter.

“I’m not sure what else I can do other than warn people away!” he said.  

How Brave works

Brave works by automatically creating a record in its system for thousands of YouTube and Twitch channels, media outlets, and other domains, based on its users visiting those sites. Once Brave creates a profile on you, that’s it. You are in the system, and Brave’s users are able to send you donations in the form of BAT.

Eich doesn’t like the idea of opt-in. He thinks it kills user growth.

According to Brave’s terms of service, once Brave collects BAT tokens in your name, you have 90 days to pick them up. After that, unclaimed tips that originated as grants go back into the system to eventually get redistributed, while tips that came from user-funded tokens are frozen indefinitely. 

How do you know if BAT tokens are waiting for you? According to the project’s website, you can find out by verifying your domain through Brave. Otherwise, once Brave has accumulated $100 worth of BAT tokens on your behalf, the system sends an email to the webmaster and the registered domain owner of your site, based on WHOIS information. The email explains how to verify the ownership of your website.

A Hacker News user going by the handle “britch” had a nice way of explaining how all this works.

“You’re taking money for people without a good way of getting it to them (or ensuring that they want the money at all).

My friend Mark had an accident and I think he needs help paying for it. Would you give me some money to help Mark pay for his medical bills? Thank you, I’ll just put it in my bank account until Mark asks me for it.

Trust me, I’m trying very hard to let Mark know I have money for him. I’m going to send a letter to his parent’s house so he knows that I have money for him, but only when I get $100. In the meantime I’ll just hold on to the money.

Oh Mark never got the money you gave me to give to him?

Well, you only gave me $75 so I never sent him a letter.

Well, it turns out Mark isn’t on speaking terms with his parents, so he never got the letter.

Well, he has health insurance and didn’t need the money after all.

Where’s the money now? I guess it’s still in my bank account. No you can’t have it back.”

At present Brave does not have a fully functioning wallet. If you want to claim your creator contributions,  you have to register with Uphold, a third-party wallet provider and cryptocurrency exchange service. What this means is, instead of having full control of your private keys, you have to trust them to a custodial exchange. If Uphold were to be hacked, there goes your money.

According the the Brave FAQ, you can fund your Brave/Uphold wallet by sending bitcoin, litecoin, or ether to your wallet address. Once you do, those funds automatically convert to BAT. And once you have BAT in your wallet, you cannot move BAT out of your wallet. You can only use them on the Brave browser. 

Some critics think Brave would have been better off using ether or bitcoin as its native crypto. In fact, Brave was initially built to use bitcoin, but Eich felt it was a poor fit.

“We used bitcoin, it was terribly slow and expensive to buy in moderate amounts. We also could not give users grants of it, because no bitcoin holder was willing to give us a big pool of coins to hand out. You might think those are not bitcoin problems. They were for our users,” he said in a tweet earlier this year.

Creating your own token has another benefit: you can use it to raise money.  

Token sale

In an initial coin offering (ICO) in June 2017, Brave raised $35 million in less than 30 seconds. According to CoinDesk, only 130 people participated the token sale and five buyers scooped up about half of the supply. One billion BAT tokens were sold.

Separate from that, Brave keeps 270 million BAT in so-called a user-growth pool (UGP). It uses these as an incentive to get users to use the browser. The project keeps another 75 million BAT in a “BAT development pool.” Essentially, Brave controls 23% of the total circulating supply of BAT.

Brave promotes itself to publishers as a way to “monetize your content.” Despite that, Eich does not see BAT as an actual currency. He sees it as a utility token.

The U.S. Internal Tax Revenue Service treats all cryptocurrency as property. Meanwhile, the SEC chairman noted in December 2017 that ICOs are, in fact, securities and projects launching ICOs need to register with the SEC, or apply for an exemption. The SEC’s settlement with Munchee around the same time, made it clear that simply having a token that offers utility on the network is not enough to exclude that token from being a securities offering.

What Brave plans to do

As a result of Scott going public with his concerns, on December 22, Brave issued an update to its Brave rewards program.

The platform now makes it clear whether a publisher has verified their domain. If a publisher is not verified, Brave includes a note in the tip banner that says, “This creator has not verified their site. As soon as they verify with Brave, they will receive your tip.”

Brave is also now excluding headshots in its tip banners for YouTube and Twitch channels.

In the near future, Brave also plans to add an opt-out feature for publishers. That might work fine for publishers who already know they are in Brave’s system, but many have no idea. The important thing to note is there is still no opt-in feature. 

And while Scott says the updates are a step in the right direction, he thinks the fundamental problem is still there. 

“Brave accepts donations for a huge number of people without consent, and in the overwhelming majority of cases, those donations aren’t going to the recipients. Aside from any issues with GDPR and privacy, that’s just unethical: this should be opt-in, not opt-out!” he said.

Scott has since sent Brave a formal right-to-be-forgotten request. Brave has one month to reply. 

Update (December 27, 2018): After original publication of the article, The Block reached out to Brendan Eich for comment on the recent updates to Brave Rewards. Eich’s comment in full: “Thanks to feedback from Tom Scott and others on Twitter, we released a fast fix to avoid showing unverified creator images or profile data in any Brave Rewards tipping user interface. We are now working to restrict tipping of user-funded tokens so they may be given only to creators who choose to opt in. We will release this change soon in the new year.”

(This story has also been updated to clarify how Brave handles uncollected publisher tips and to reflect how much of the total circulating supply of BAT tokens Brave controls, according to Eich.)