For example, requests for software update have to go to Mozilla, but don't have any personal information, and are legitimately necessary.
It might be done without bad intentions, but do Mozilla ask consent before asking their users data about when they are using Firefox, and so that they are (possibly) in front of their screen.
Consent only required for personal data. Absence of visible settings suggests those who trade browser silence for safety is a minority, not target audience. It is open source, you can make own build.
No it isn't.
2) track IP address
Risk: very high because they rely on user trust to survive and they could get sued into oblivion under the GDPR.
Reward: they now have a list of IP addresses with Firefox users behind them. Any big website has that so it's not valuable to third parties and it's not valuable to Mozilla because they don't do any targeted advertising or anything similar.
A list of IP addresses is about the least useful thing to log if you want to track people.
¹ except of course any updates and binaries that firefox downloads and gobbles up behind the users back.
I'd argue updates are legitimately necessary for 99% of users (automatic updates are a huge reason why 90% of home PCs aren't in a botnet, and were a big reason why Chrome more secure in the old days vs IE/Firefox), and if you want to disable them it's very easy to do (about:config -> app.update.auto = false). But I don't know why you would, if the browser is changing too much for you you can change to ESR which is security updates only to older versions of Firefox.
Yes, automatic updates are pretty much necessary for about 90-99+% of users, but many lot of them are using system packages (which again, should not be able to update isself), and it is still not a reason why there shouldn't be a way to disable random background connections.
One could argue a silent browser is legitimately necessary for security research/operations, or just severely data-constrained networks, but I have yet to find a way to make firefox quiet.
Will app.update.auto disable all updates (browser, search engines, safe-browsing, user-test, blacklists.. there was at least a dozen features)? Last time I tried disabling almost everything suspicious, yet firefox wouldn't respect half of the settings.
Having an option to disable them would be a footgun. Such "radio silence" serves no useful purpose to normal users, but can make the browser appear buggy, e.g. if tracking protection broke a site, and you wouldn't get a fixed blacklist in a timely manner.
Someone has to host these dynamic components, and the browser has to get them somehow. IMHO it's way better if they're fetched straight from Mozilla that has strong privacy policy and a good reputation to uphold, rather than from some rando free distro mirror.
First of all, all of these things can be turned off; second, checking if you are using an outdated, potentially insecure browser is essential - if there is a vulnerability, the least of your problem will be that one goddamn ping to a mozilla domain...
They cannot. Reporting off, telemetry off, automatic updates off, every related setting in about:config off -- Firefox still transacts data with not one but several Mozilla domains upon launching.
Mozilla can't ethically constantly talk about privacy out of one side of its mouth while collecting data that can be used to track users who have explicitly requested them not to do that out of the other side.
1. They can if they're an order of magnitude better than everyone else, just like electric car makers can talk about being environmentally friendly despite the fact lithium isn't renewable
2. Are you sure it's tracking? What data is actually sent? Crash reports, update checks, network tests, motd fetching, cache preloading... don't count as "tracking users". Hell, even reporting on statistics (version, OS, platform, region...) isn't actually tracking users, but FF lets you disable that regardless because they know some people don't like it.