When Dimitri Sirota approached investors two years ago to raise a seed round for his new company, BigID, many were dismissive of the idea behind the startup, which creates technology that helps companies find what personal data they have collected from customers and get recommendations on how to secure it. In the meetings, some of the venture capitalists fiddled with their phones, while others dozed off, Mr. Sirota said.
Now, Mr. Sirota said he fields up to six calls a day from investors looking to invest in his company, even after raising two rounds of funding this year. “Everyone thought we were stupid, and now everyone is paying attention,” said Mr. Sirota, BigID’s CEO. “I would even say it is feverish.”
Data privacy has burst into the public consciousness, propelled by the controversy over Cambridge Analytica’s misuse of Facebook data and new privacy regulations in Europe and the U.S. The topic has also captured the attention of entrepreneurs and venture capitalists, who increasingly see opportunities for startups that cater to the privacy concerns of individuals and businesses. Money is flowing into businesses that do everything from helping individuals browse the internet privately to giving businesses tools for protecting customer data.
Last year, venture capitalists invested more than $497 million in privacy-related startups globally, more than triple the amount they invested five years ago, according to estimates from Pitchbook, a research firm that tracks investments. So far in 2018, privacy-related investments are more than $506 million, with three months left to go in the year.
Startups that focus on privacy have been around for years, sometimes struggling to get traction. One category, virtual private networking technologies—which encrypt users’ internet connections to allow secure, anonymous web surfing—first emerged in the 1990s and was mostly used in specialized corporate settings. But in recent years VPN usage has become far more common among consumers, especially in countries with more intrusive forms of internet surveillance and censorship.
One startup in the category is AnchorFree, which makes a popular VPN app called Hotspot Shield. The company raised $295 million in funding last week. David Gorodyansky, CEO of AnchorFree, said the company’s VPN has been installed on more than 650 million devices globally, up from 100 million five years ago. Mr. Gorodyansky said the company saw big increases in the installation of its VPN app by U.S. users after attention-grabbing events like Facebook CEO Mark Zuckerberg’s testimony on Capitol Hill.
“Security and privacy challenges are growing every day. You have all of these high-profile privacy and security concerns, like Equifax and Cambridge Analytica,” said Mr. Gorodyansky. “All of these things contributed to a lot of growth here at AnchorFree…This is a pretty phenomenal opportunity.”
Privacy startups cover a broad range of territory. Some, like BigID, are aimed at enterprise customers, who are scrambling to comply with new data protection regulations like the California Data Protection Act and Europe’s General Data Protection Regulation, better known as GDPR. There are privacy startups that help enterprises secure their customer data with tools like encryption, which protects personal information in the case of theft. Some provide tools allowing companies to use data so that it is not personally identifiable, limiting risk for accidental exposure or misuse.
Public interest in privacy is also spawning consumer startups in secure communications and private browsing. Emerging are companies that help people find out if their private information is being circulated on the dark web, the shadowy, difficult-to-access areas of the internet where stolen personal data, drugs and weapons are sold.
While consumers aren’t compelled by regulation to meet new standards, there’s growing evidence that many are taking measures to enhance their privacy online. The Pew Research Center released a report last week that said 74% of Facebook users have adjusted their privacy settings in the past 12 months, while 26% said they deleted the Facebook app entirely.
“Everyone thought we were stupid, and now everyone is paying attention,” said Dimitri Sirota, CEO of BigID. “I would even say it is feverish.
Enrique Salem, a managing director at Bain Capital Ventures, said he is actively looking for investments in companies that help keep data secure and private and that help businesses meet government regulations. One recent Bain investment in the area is LeapYear Technologies, which allows companies—Apple is a customer, Mr. Salem said—to get access to user data for analysis without needing to know the identities of the people it belongs to. While the idea of protecting data isn’t new, the category has come back to the forefront with new overlays of regulation and broader data privacy concerns, he said.
“I think those things coming together, plus the amount of data that everyone is using every day, makes it an area ripe for investment,” he said.
On top of the opportunity to invest in a new category of technology, some venture capitalists, like Bob Ackerman, founder, and managing director at AllegisCyber, a venture capital firm that focuses on early-stage cybersecurity investments, see the category as an important one for investment for societal reasons.
“From a democracy, privacy and freedom perspective, it is essential,” Mr. Ackerman said. “For me, this discussion we’re having is a very high priority.”
Mr. Ackerman has also noticed a phenomenon of startups with only a peripheral focus on privacy using buzzwords like GDPR in their pitches to grab his attention. He tries to avoid the ones that are merely jumping on the privacy bandwagon and looks for more meaningful technology. “Entrepreneurs are clever,” he said. “I think a lot of people are trying to wrap themselves in the GDPR and privacy flag.”
Sizable acquisitions of privacy startups are also sparking more interest in the category. Last month, a company called InfoArmor, which sells an identity protection technology, was acquired for $525 million by Allstate, the insurance company. Dino Boukouris, director at Momentum Cyber, a boutique mergers and acquisitions consultancy, said the InfoArmor sale demonstrated that high returns are possible for investors in the category.
“As an investor and operator in the space, I see these all as positive signs for the industry as a whole,” he said.
