I noticed that DuckDuckGo's favicon.ico is only about 3 KB, even though it contains both 32×32 and 16×16, 32-bit icon images. A comparable favicon with the same sizes is closer to 6–7 KB. Inspecting the files shows that DuckDuckGo's images are compressed inside the ICO file, while the others appear to use uncompressed bitmap data. How is this done, and what tools can create an ICO containing compressed images at these smaller sizes?
3 Answers
The compression is not special favicon compression or server-side gzip. The PNG data is stored directly inside the .ico file. Older or less capable icon editors commonly write raw BMP frames, which accounts for the larger 6–7 KB files.
Encode each icon image as PNG, optionally optimize those PNGs with tools such as oxipng, optipng, or pngcrush, and then package them into the ICO container. ImageMagick and icoutils’ tools can create ICO files with PNG-compressed entries, although you may need to check the resulting file to make sure it did not convert them back to raw BMP data.
An ICO file is really a container for one or more images. Each entry can contain either traditional uncompressed bitmap data or a complete PNG file. DuckDuckGo’s favicon is using PNG-encoded entries, which is why it is much smaller. PNG entries are supported for icon sizes below 256×256 as well; they aren’t limited to Vista’s 256×256 format.

That explains it—I had assumed the PNG format was only relevant to 256×256 icons. It works for the smaller entries too; the difficult part is finding an icon editor that preserves or creates PNG-backed entries.