Hacker News Reader

Comment by move-on-by | Hacker News Reader

> The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”

THANK YOU California for this definition of selling data, which is accurate, and representative of what people think of when discussions of selling data come up.

> In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners

Ok, so that’s pretty straightforward. According to CA and other states Mozilla is collecting and selling your data. Which is exactly what everyone is upset about and means exactly what everyone thought it meant.

View on HN

They also said "Mozilla doesn’t sell data about you (in the way that most people think about “selling data”)", and I'm struggling to fathom what they could possibly think that "most people" think selling data could mean other than "giving your data to someone else for compensation", which seems pretty much exactly what the California law says. Yes, it's embedded in some legalese, but surely Mozilla has lawyers?

Most people probably envision selling data akin to shady person trading usb stick in dark alley or hackers selling huge batches of stolen data, so that statement will be true almost by default

most people I speak to about this tend to imagine selling data to be like people cold calling you with scams, getting suspicious advertisements that happen to be about stuff you just happened to be saying in the other room (which actually happened), and stuff like that. in Mozilla's case I'm pretty sure it's whatever Pocket is, considering how difficult it is in Firefox to turn that garbage off

I think they're trying to make the distinction between "we sell your searches and clicks attached to your personal id" and "we sell derivative aggregated information like we have a lot of users of X style to advertise to". But it's kinda hard to sift through exactly what they can and can't sell under this.

Wouldn't derivative aggregated information not be included in definitions like the one quoted because they specifically about personal data?

If you sell the information how many customers you have and how many shoes you've sold last month, are you selling your customer's personal data?

> If you sell the information how many customers you have and how many shoes you've sold last month, are you selling your customer's personal data?

To make that analogy fair for the scope of what Mozilla's doing, the shoe store would have to be selling data about what color shirts people are wearing when they visit the shoe store.

That is fair. But a more accurate analogy would be that the sales representative that goes to people house is reporting to the store what color people are wearing at home.

Firefox is installed on my computer, not on a VPS owned by Mozilla. I'm not browsing Mozilla website. Why are they entitled to record and share everything I do?

Most people don't think about this stuff and are simply uninformed. Referring to what "most people think" is a cop-out from their side.

But I think the sense Mozilla are referring to is the more obvious and over-the-top things like selling your name, phone number, email, postal address, your Amazon purchasing history, or to ramp it up more, your passwords, your credit card info etc.

The latter is a pretty high bar. Even Google doesn't do that.

Just saying that you can stretch it pretty far with vague language like "we aren't doing [bad thing] in the sense that most people would understand [bad thing]".

CCPA/CPRA have a very broad definition of sale.

> (1) “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration.

Most people would view a sale as Mozilla getting cash back for the data. But that "other valuable consideration" (which the AG declined to clarify or create a factor-based approach for deciding) makes Mozilla vulnerable to lawyers.

The same parasites that claimed that embedding a chatbot on your website violates the California wiretapping laws and have been extracting cash from sites will figure out a way to do the same to Mozilla. see the wave of CIPA chatbot lawsuits.

For instance, suppose Mozilla partners with a search engine and could be claimed to get a discount or some other consideration for letting that search partner use search terms to improve the search engine. Something that isn't advertising related at all. That's probably a sale under CPRA.

> For instance, suppose Mozilla partners with a search engine and could be claimed to get a discount or some other consideration for letting that search partner use search terms to improve the search engine. Something that isn't advertising related at all. That's probably a sale under CPRA.

If a search engine partner wants to use search terms to improve their search engine, they only have to look at their own logs. They don't need Mozilla to collect, aggregate, and sell them any data to accomplish that. Mozilla doesn't need to worry about selling data if they never possess that data in the first place.

Your complaint about "other valuable consideration" is just a complaint that the law isn't crippled by stupid loopholes.

> Your complaint about "other valuable consideration" is just a complaint that the law isn't crippled by stupid loopholes.

That's not the law. The search engine partner using those logs is probably valuable consideration and hence a sale. Mozilla doesn't even need to keep the data; just an api passthrough will qualify.

> The search engine partner using those logs is probably valuable consideration and hence a sale.

It's not a sale when the search engine doesn't get those logs from Mozilla. When a user sends a search query to Google using a Mozilla browser, it's Google's privacy policy that applies, not Mozilla's.

> Mozilla doesn't even need to keep the data; just an api passthrough will qualify.

There is no API passthrough in this scenario. Search queries go to the search engine directly without being relayed through Mozilla servers. Anything that does hit Mozilla's servers is entirely optional and unrelated to the purpose of satisfying the user's request for search results.

You don't need to speculate about how this could all be due to innocent ordinary operation of a web browser when Mozilla has already disclosed that they're voluntarily tracking users in ways that are not necessary for the operation of a web browser.

This is a funny case where Mozilla thought they are clarifying their position by pointing out how ridiculously CA defines "sales" only for it to blow up in their face. This is not the first time it happens to companies where in an act of desperation they issue some "apology" or explanation only to make the whole thing worse.

Now people will read even more carefully their privacy policy https://www.mozilla.org/en-US/privacy/firefox/#notice and may find things like:

> Firefox also shows its own search suggestions based on information stored on your local device (including recent search terms, open tabs, and previously visited URLs). These suggestions may include sponsored suggestions from Mozilla’s partners [...] or relevant URLs that are popular in your country.

> Mozilla processes [...] how many searches you perform, how many sponsored suggestions you see and whether you interact with them.

> Mozilla collects technical and interaction data, such as the position, size, views and clicks on New Tab content or ads, to understand how people are interacting with our content [...] This data may be shared with our advertising partners on a de-identified or aggregated basis.

> we share data across Mozilla-controlled affiliates and subsidiaries. We [...] disclose personal data as part of a corporate transaction, such as a merger, acquisition, sale of assets or similar transaction

> [...] retain personal data for more than 25 months, but actual retention periods may vary depending on the type of data and the purpose(s) for which it was collected

[Definitions]

> Technical data : Device type, operating system, IP address, ISP

> Settings: Enhanced Tracking Protection settings, cookie settings, permissions (location, camera, microphone), toolbar customization.

> Location : Country code, city.

> Precise Location: Your precise location (within a few feet or meters).

> Interaction data : How many tabs you have open or what you’ve clicked on. Click counts, impression data, attribution data, how many searches performed, time on page, ad and sponsored tile clicks.

> Browsing data: [...] websites and URLs you’ve visited. [...] (travel, shopping, social media), top level domains (example.com) or specific web pages visited.

Based on the parent, all the collected data preserves privacy:

> Firefox also shows its own search suggestions based on information stored on your local device

That data stays on your computer ...

> Mozilla processes [...] how many searches you perform, how many sponsored suggestions you see and whether you interact with them.

That description contains no user content: number of searches, number of ads, whether you interact says nothing about you - it doesn't say what you click on or see, just that you clicked.

> position, size, views and clicks on New Tab content or ads

Again, there is no content mentioned, just number of clicks and not what you click on.

> [Definitions]

This section defines terms; it doesn't say they are doing anything.

How do they decide which sponsored ad to show you?

Usually it's the sponsor who decides. Because, for example, it's pointless to show Walmart ads in North Korea. (I'm not a mz insider)

On your device: "Interests: Candles, Wooden Sculptures, Underwater Basket Weaving"

Advertiser: "Show this to users who like Candles."

Mozilla: "OK"

That's pretty standard and can be used to track people on the advertiser's side still, depending on how the ad itself is served and how clicks on the ad are processed.

Does Firefox download information about every ad that advertisers have paid for, and then match against local data to decide which ad to serve?

If not, when it queries to find out which ads to serve, what data does is sent with that query (or prior to that query)?

Firefox has done a lot of work on these problems. I don't have it in front of me, but they described in detail what they do.

I'm sure the internet police's thorough investigation into themselves has shown they are doing nothing wrong.

I don't know what that's based on or means, but they do have the mission of protecting privacy and this would be a core contribution to that:

https://www.mozilla.org/en-US/advertising/

I haven't been able to find any documentation of this, other than "we acquired Anonym, which claims to send the data to trusted execution environments".

They've been working on it since long before Anonym. First three links from my search:

https://www.mozilla.org/en-US/advertising/

https://www.mozilla.org/en-US/foundation/annualreport/2024/a...

https://www.mozilla.org/en-US/advertising/principles/

It's a great question, and that is the tech Mozilla / Firefox have been working on and using for years.

Advertising is, unfortunately, necessary to funding most of the web, and targeting is necessary to advertising. As a result, users are surveiled and tracked heavily.

But imagine if the targeting could be done without surveillance and tracking - then users could largely use the web in private. It would be revolutionary. That's what Firefox has figured out and is investing more in:

https://www.adexchanger.com/privacy/mozilla-acquires-anonym-...

I wish this was more obvious that they don't identify what the 'clicked' New Tab content is. And for Search it could be stored local information and be tracked for suggestions. I wish they clarified the things you clarified instead of failing to mention them.

I think that's a great point. I think organizations are careful not to interpret carefully worded legal prose, to avoid undermining the legal position. But that limits understanding of these things to lawyers who can interpret the legal prose.

When you keep the ip address, that often gives people everything that they need, along with "fingerprinting" data. Especially governments and huge corps like facebook/google/amazon, as they have you IP @ {date}/{time} as well. Match it up and you have the golden calf.

I feel like there _is_ some daylight between what people hear when someone says "Firefox is selling your data" and, for example, Firefox using your IP address to put you in a rough country-level geoblock to determine whether to show you an ad that was sold to all users in a country.

Yet the second one, which I think would be very much considered close to harmless from my perspective (compared to an alternative of "an ad is shown to everyone across the world"), would, I think, still fit into this metric of your data being sold.

Though maybe I'm misinterpreting what the CCPA's breadth would be.

I have been a bit disillusioned by FF for some time, and would like for them to figure out some version of a business model in order to survive, and so we can know the contours of that business model. Trying to play "we do not do business things at all" with them constantly shipping weird ad-ful features and stuff like Pocket... let's see if we can make this honest!

> let's see if we can make this honest!

They're beholden to who gives them money, which is not us.

It could be us, either directly with money, or even just indirectly by “being the product” but being able to just walk away.

FF exists off of good will and the search deal. The more people stop using the browser the less they’re going to pull in from the deal.

> FF exists off of good will and the search deal

Firefox exists off of google and their antitrust deal.

> Firefox using your IP address ... to show you an ad

Why do you imply that Firefox showing ads is acceptable ?

They have been doing for at least a decade by now (e.g Amazon). So why imply it suddenly isn’t acceptable to show ads (in any form)?

> They have been doing for at least a decade by now (e.g Amazon). So why imply it suddenly isn’t acceptable to show ads (in any form)?

Because it isn't acceptable.

The first thing I've done (for years now) when configuring Firefox is to turn off many of the defaults. Advertisements, pocket, search engine, online spell checker, translator, blah blah blah.

I mean they integrated pocket right? They sold the default search engine position for billions. That’s something! Not all money making efforts are created equal, though. We judge based on what the effort is in context!

I chose firefox because I don’t want my browser to build an ad network to sell targeted ads.

And I definitely don't want this:

> You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content. [0]

[0] https://www.mozilla.org/en-US/about/legal/terms/firefox/#you...

Exactly.

Why is my browser serving me advertising in the first place? Because Mozilla is an advertising company now.

Yes, ad first company, with a browser product to capture ad audience.

There are only two ways to generate revenue: direct and indirect. Nobody will pay for a browser.

I don’t use Firefox and this whole thing is distasteful, but I’m not sure how they’re supposed to cover operating expenses without indirect monetization, or what for of indirect other than ads would work.

In the meanwhile, people are asking how to donate to Firefox not to Mozilla and it's CEOs whims and personal salary.

> Nobody will pay for a browser.

Speak for yourself.

Give me a browser that clearly and unambiguously does not sell my usage of it in any way, and I will give you a monthly subscription.

Well yeah and I do pay for Kagi but would still say “nobody will pay for a search engine” using “nobody” in the “not enough people to scale a mass market business” sense.

Horse Browser? https://gethorse.com

Built on top of chrome (electron actually). Same issues as every other chrome form. Also, doesn't support extensions.

> There are only two ways to generate revenue: direct and indirect. Nobody will pay for a browser.

There's a third way: screw revenue, dump all staff not related to browser development and documentation (MDN) and look for government grants to fund that.

Especially the EU may be a target for a well-written proposal, given the political atmosphere it would make sense to have at least one browser engine that is not fundamentally tied to the US and its plethora of bullshit like NSLs.

> Nobody will pay for a browser.

I would, if they offered a payment-only access to Firefox with no added services and no telemetry whatsoever. I'd pay 50€ a year for that.

It’s a weird term, but I’m not sure how “for the purpose of doing as you request” is terrible. To me that means that when you type a url, they have the right to do a DNS lookup for it.

Is there some interpretation where “for the purpose of doing as you request” means any purpose they want?

The problem is that I'm not requesting Mozilla do anything. Firefox isn't a "service" it's a web browser. When I input a seach query, _I_ am acting on my behalf, not Mozilla.

I don't want any language where they get to insert themselves into that chain of behavior. Curl doesn't need a TOS, why does Firefox?

Very much this. The browser already have all the features to do what I want it to do. Why does Mozilla insists of being a middleman? It's my computer, Firefox code, and someone's server.

I agree. The very fact that they added a Terms of Service is weird. I don't want Firefox to be a service in any way. It's a tool.

When I drill a hole in my wall, DeWalt don't tell anyone who I am, how large a hole it is, what material I drilled into or even the fact that I actually drilled anything. They don't know any of that, and neither should Mozilla know when my local copy of the browser makes a DNS, HTTP or any other request.

And they should use the system DNS services for that, not their own partners.

this is why I use librewolf

And I chose Librewolf because I didn't want that, either.

Mozilla, then Phoenix, then Firefox user for over 27y or so.

If they can't stop abusing their users, I will look for another browser, goddamnit.

> If they can't stop abusing their users, I will look for another browser, goddamnit.

This seems to go beyond "can't stop" to "are actively plotting a course to continue." I've seen a lot of missteps from Mozilla over the years, but I never thought I'd see them selling my data. From seeing the news yesterday to today, I know now I have to stop recommending Firefox, and figure out a browser that I can trust.

They are only three viable web-engines left over from the second browser-war:

  * Blink (Google): Used in everything, from Chrome, Edge, Opera, Qt-Toolkit, Electron.
  * Gecko (Mozilla): Firefox. And Waterfox? I assume Gecko is still hard to integrate.
  * WebKit and WebKitGtk (Apple and Gtk): Safari, Epiphany and Gtk-Toolkit. Easy to integrate. And the only engine where I’m aware that actually two side actively cooperate in development.

Epiphany is small and nice, but they need a lot more developers. And I think they should use ffmpeg, gstreamer seems to be a source of issues for many years. But again, they need us, every helper capable of C++ is welcome.

Ladybird an another new engine, implemented in C++. But it is in alpha-state, only for developers. Everyone else who tries to show us a new browser means “use that Google thing with another name on it”.

Though not yet ready for the public don't forget the promising https://servo.org

(It is very usable already in combination with Tauri as alternative to Electron + Chromium)

Some more:

* Librewolf, Palemoon, Falkon.

Librewolf is Firefox plus minor patches.

Palemoon is based on an outdated fork of Gecko.

Falkon uses QtWebEngine, which is Blink.

WebKit is also used in Orion, but that browser is macOS/iOS only.

They've started work on a Linux version, too.

I'm still hoping for something to come out of Servo.

I honestly think we need to shift our trusted computing base off of C/C++. There's no way a ragtag bunch of volunteers puts enough effort into security when every minor mistake is a disaster :-(

Librewolf is a Firefox fork with this crap removed.

And if everyone switches to Librewolf, Librewolf will die because Mozilla will no longer make money and won't be able to devote resources towards maintaining upstream Firefox.

I use Firefox. I hate ads. I don't love that Mozilla engages in some level of affiliate deals to pay the bills, but it's the only viable alternative to Google controlling the entire web and doing much worse tracking/advertising at this point, unless Mozilla can figure out some other revenue stream.

Chromium-based "privacy-focused" browsers can only exist as long as they're not popular enough to move the needle on Google's ad business. Firefox derivatives can only exist as long as Mozilla can pay the bills, which they almost certainly can't do if nobody uses Firefox (no reason for Google to pay for search priority for an audience of zero, and no affiliate deals for an audience of zero).

The more people use Firefox forks, the sooner Google controls everything. You might personally benefit in the short term, with "complete" privacy, so I can understand why some might choose that option, but you need to accept that you're contributing to Google's dominance by doing so.

> Mozilla will no longer make money

Mozilla could have added years ago a donation or subscription to fund the development of Firefox, but they don't want that. Mozilla wants all the money for its charitable activities instead.

There will be a time when they have no money anymore, but it's only their fault.

I doubt donation would be anywhere close to what is needed for development even if that exists.

I think it's not that they don't want it as it's difficult to mix money from commercial activities with donations. That's why they keep the two cash flows separate and are only using Google money for Firefox development, and spend donations exclusively on political bullshit very few people care about.

Although their $7 mil CEO could have found a way to handle this while not running afoul of the IRS, but she decided to play with a bunch of dead-end commercial endeavors instead. So that's on them.

> Mozilla wants all the money for its charitable activities instead.

Describing Mozilla's derailment as "charitable activities" is like describing the Mexican cartels as "self-help groups".

Never forget their "We need more than deplatforming".

Na, Mozilla will die and Firefox and Thunderbird will get transferred to a community project, Thunderbird survived without Mozilla so will Firefox.

Pretty sure that community project will get overwhelmingly big donations from all over.

A web browser is much more complex software than an e-mail client, though.

If whole operating-systems can survive out in the open a browser can too.

Software don't need AI-hyping 6 million dollar swallowing CEO's

A web browser doesn't need to scope of "copy every thing Chrome does".

If even a tiny appreciable amount of user move to librewolf, Mozilla will fix their business model.

They were doing fine as a business under Eich, whatever you think of him. They make over $500M just from their search box - and frankly, that is way more than you need to make a fantastic browser. And Thunderbird.

Baker took home over $7M a year for the past six years, and though she stepped down as CEO, we don't know if they even cut her pay, or what the other top tier salaries are [1]. Mozilla is a "open" company, but they announced that they will "not be disclosing salaries" after Baker stepped down.

Kagi makes a browser with 35 employees and ~200K inn sales. And I know, they are not building from scratch - but neither is FF at this point. It is ridiculous to suggest that Mozilla will go under if they don't become spyware.

[1]: https://www.mozilla.org/en-US/about/leadership)

You're saying "will" but what are you waiting for? How many data points do you need to leave FF now they're admitting to collect data and willing to display their own targetted ads, that they make deals with Facebook in addition to making deals with Google, that they're green-washing and pushing Google's efforts to take over the web as a targetted ad medium which has resulted in abandonment of almost all browser development and their own browser share drop to low single-digit figures, with funds directed towards nebulous virtual signalling campaigns but mostly to their management and certainly not towards development or the better of the web?

> I will look for another browser, goddamnit.

Well do it, i had Firefox on all my machines for about 15 years, change to librewolf took like 20 minutes on all machines...and it even feels more responsive, and i dont have have to install uBlock manually and other settings by hand, like disable those experiments mozilla can install:

https://librewolf.net/#main-features

And if you de-install firefox on windows you can even tell them why you did it ;)

Yes, here too, add Mosaic and Netscape there. Switched to Waterfox, would pay for a full fork.

there are many offshoots, zen, floorp, librewolf (if you want that classic feel), waterfox, etc

Mozilla is continuing to dig its own grave

If they would simply tell us what part of Firefox is affected by the CCPA's definition of "selling user data", there would be no room for misinterpretation and this would be over.

If it's as innocent as "Firefox has to send HTTP packets to arbitrary web servers to achieve the fundamental function of loading a page" and that web server is considered 3rd party by CCPA, then everyone would understand... this is either poor communication or they are hiding something else (which everyone should rightly assume in this day and age).

Just tell us already Mozilla!

From the article:

> In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners, including our optional ads on New Tab and providing sponsored suggestions in the search bar.

And remember, they’re citing CCPA’s definition as meaning “… in exchange for ‘monetary’ or ‘other valuable considerations’”. This is exactly what people mean by “selling”.

It’s not the innocent thing you’re contemplating, about a browser doing its job. It’s specifically about things like serving ads, making that browser “commercially viable”.

Mozilla is stopping claiming they’re never selling your data because they’ve been selling your data for the last few years.

Selling ads isn't even the problem. They could do that and still truthfully, legally claim they never sell your data.

Mozilla is helping perpetuate the illusion that online advertising necessarily includes collecting and selling data about the users who are shown the ads.

AFAIK they do the opposite: They've pioneered ways to target advertising without your data leaving your computer.

See for example,

https://www.adexchanger.com/privacy/mozilla-acquires-anonym-...

"That shared mission is predicated on the notion that advertising and privacy are not – or at least don’t have to be – mutually exclusive."

And it goes into detail on the investment and technology in that area.

If they've pioneered such technologies, they aren't using them. Their Privacy Notice enumerates many types of data that Mozilla collects and passes along to "partners"/advertisers. For example:

> Mozilla collects technical and interaction data, such as the position, size, views and clicks on New Tab content or ads, to understand how people are interacting with our content and to personalize future content, including sponsored content. This data may be shared with our advertising partners on a de-identified or aggregated basis.

There's a lot of tracking data that does leave the user's computer, and Mozilla is trying to justify it by assuring us it's sufficiently anonymized and aggregated—assurances they would not need to make if the data wasn't changing hands.

It's also silly to suggest that targeting advertising without tracking users needs to be "pioneered". It's obvious that Mozilla could have the browser download this month's list of sponsored search keywords and have the browser check search strings against that list, without going off-device. There's no innovation required to implement that. All the attempted innovation is focused on how to exfiltrate data in a form that they can get away with selling.

> There's a lot of tracking data

It's meaningless data to you: It doesn't say what you click on, just where and how big the ads are, and how many times you click. It doesn't identify you or reveal anything about you, except that you clicked on some unknown ads.

> It's also silly to suggest that targeting advertising without tracking users needs to be "pioneered". It's obvious that Mozilla could have the browser download this month's list of sponsored search keywords and have the browser check search strings against that list, without going off-device.

These are the words of someone who hasn't done it. Look at the article; what advertisers want and what the privacy-destroying competition does is much more sophisticated than what you describe. For example,

Anonym also has technology that allows ad platforms and advertisers to securely share encrypted impression and conversion data within a trusted execution environment for attribution, causal lift measurement and lookalike modeling. (A trusted execution environment is the secure area of a main processor where code can be run safely and in isolation.)

To be fair, the major ad platforms have long offered attribution and measurement solutions, Mudd said. “But they required the data to come into their system,” he added. “In this world, that doesn’t have to happen.”

> It's meaningless data to you: It doesn't say what you click on, just where and how big the ads are, and how many times you click. It doesn't identify you or reveal anything about you, except that you clicked on some unknown ads.

I'm not sure what you mean by "meaningless data to you". Obviously, the data Mozilla is collecting, aggregating, and selling is meaningful to the buyers. And you're straight up lying about the extent of the data, directly contradicting Mozilla's Privacy Notice.

> Look at the article; what advertisers want and what the privacy-destroying competition does is much more sophisticated than what you describe.

Obviously? What I was describing was how it's possible to target an advertisement without doing any user tracking. What the advertisers want to do and are doing is tracking users as much as they can get away with. And that includes the ad tracking company Mozilla bought.

> you're straight up lying

You are going too far in your 'pile on Mozilla' performance.

> It's meaningless data to you

I decide whats meaningless to me. Not you. Not mozilla.

Is that "obviously" true? Like if they had ad targetting and also let buyers of ads see aggregate results of impressions or something, that might already fall into user data being sold, right?

At what point does user data stop being user data? I don't think aggregation is enough in some of these discussions, but maybe I'm wrong.

> Mozilla is stopping claiming they’re never selling your data because they’ve been selling your data for the last few years.

If that's true then it sounds to me like there's some liability to sue for in California courts against Mozilla. I wonder if EFF would be interested

CCPA/CPRA has no private right of action for this kind of thing. Only the CA AG can bring forth claims, and penalties would be paid to the state, not individuals, in that case.

Most of what is collected is recorded in about:studies and about:telemetry. You can disable studies in Settings, and I think most of telemetry.

What is collected by telemetry is documented here for desktop [1].

[1] https://firefox-source-docs.mozilla.org/toolkit/components/t...

Would it have been better if Firefox/Mozilla went under as a result of never compromising on their principles for income 5 years ago, as opposed to continuing to exist in this less than optimal form today? If the business incompetence of where to put all the existing money were resolved.

I feel like the people who understand Mozilla's true principles have long since moved on by this point, and the crowd of those unaware still use Firefox as a daily driver, for better or worse. That crowd might have just moved to Chrome without Firefox as an option anymore.

Although, as I understand it Firefox and Chrome will be closer to each other in terms of 3rd-party data selling from now on with this ToS change.

> the people who understand Mozilla's true principles have long since moved on by this point

Where to?

I'm really liking Orion browser, unfortunately it doesn't support Windows or Linux yet

Mozilla had $1,006,854,000 invested at end of 2023. Drawing 5% of that annually for developer salaries would pay a lot of Firefox developer salaries, even with no incoming cash whatsoever. I'd like to believe a world exists between "Firefox is a volunteer-only effort" and "Mozilla CEO is yet another sociopath robber baron".

https://assets.mozilla.net/annualreport/2024/mozilla-fdn-202...

Mozilla died as a principled company the day they fired Brendan Eich because he had once donated to a cause they didn't agree with.

It became all about the authoritarianism of wokeness. They wasted so much money in ridiculous tangents and became extremely partisan and censorious.

It's still the best browser due to extensions and customization but it's sad to see these news making it not that better than chrome when it comes to privacy.

> Would it have been better if Mozilla went under

Absolutely. That would have allowed Firefox to fall to better stewardship.

Hasn't Mozilla gotten enough money that if they hadn't wasted it they could've been living solely off interest by now?

But then they would need to be given more money.

$7B was not enough to be "commercially viable" it seems.

Yes but how could their CEO's family have possibly survived then. You don't want them and the other leadership to starve if they can't have their millions per year, do you?

> According to CA and other states Mozilla is collecting and selling your data.

The definition requires Mozilla to do it "in exchange for “monetary” or “other valuable consideration.”". What consideration is Mozilla receiving and from who?

Personally, any application that even collects personal data is problematic for me. Personal data of a user has a value, and a large repository of personal data, of millions of users, makes the company valuable too. Any data collected can be monetised, if not immediately (as part of the company's business model) or in the future (when the company is sold).

With Mozilla, for example, displaying sponsored links using Firefox Suggest ( https://blog.mozilla.org/en/products/firefox/firefox-news/fi... ) means collecting and sharing personal data (like search keywords, browsing history or bookmarks). This data sharing, with another company, could either be the raw data or the processed data. In either case, it is a problematic issue for any privacy conscious and politically aware user because either party or multiple parties will (or can) create profiles from the data. "Anonymous" data collection doesn't have any meaning here because with enough data points from a particular user, you can reasonably identify a user (either to track them digitally or to even to identify their personhood in real life, for legal or political reasons). This is easier to do so if you also combine it with data from multiple sources. (Which is what the US NSA programs with US BigTech are doing, and why these companies are so valuable today - Data is the new oil).

I'm not sure you and they agree on the meaning of collect: If you input personal data into Firefox - e.g., an email you type in a Gmail - then they 'collect' it. Unless you use Firefox only for anonymous purposes, some data must pass through Firefox.

> With Mozilla, for example, displaying sponsored links using Firefox Suggest ( https://blog.mozilla.org/en/products/firefox/firefox-news/fi... ) means collecting and sharing personal data (like search keywords, browsing history or bookmarks).

That article says it's only opt-in, so you are safe:

As always, we believe people should be in control of their web experience, so Firefox Suggest will be a customizable feature.

We’ll begin offering smarter contextual suggestions to a percentage of people in the U.S. as an opt-in experience.

> I'm not sure you and they agree on the meaning of collect: If you input personal data into Firefox - e.g., an email you type in a Gmail - then they 'collect' it.

"They" in this context is Mozilla the organization, not Firefox the process in memory. For Mozilla to collect information, information has to leave my computer and end up on Mozilla's computer.

"That article says it's only opt-in, so you are safe:"

Funny, I never opt-in to that garbage - and yet Firefox keeps trying to auto-recommend things to me. It does this even in the Firefox Quantum mobile browser.

I don't think Mozilla is being 100% honest.

> Firefox keeps trying to auto-recommend things to me

If it's what I'm thinking, they do it without data about you ever leaving your computer. Look up how it's done - it's game-changing tech for privacy.

From their privacy policy [1]:

"we work with partners, service providers, suppliers and contractors"

But they won't disclose which partners and what Mozilla gets in exchange. Which is opaque, and probably intentionally so.

You can scroll down to the types of data and lawful bases they list for these data exchanges.

[1] https://www.mozilla.org/en-US/privacy/firefox/#how-is-your-d...

Yeah, "Calm down everyone, the only issue here is that certain jurisdictions have sensible definitions that mean we can't legally claim we're not selling data because we are" is arguably clarifying but it's not particularly comforting.

Seems safest to assume that if it can be tracked, it will be. And traded too.

If they intended to clarify wording, they would have added something in place of their original wording instead of deleting it entirely. Legal team isn't slipping like that.

Didn't they do that?

> in exchange for “monetary” or “other valuable consideration.”

JFC, it's funny they try to call this out as some kind of a "weird" definition when that's just... what selling is.

Usually, when I point out that Google sells your data and there’s no possible way to actually opt out, someone replies to say that’s not true, then defines “sell” in some way that most people would disagree with.

I actually laughed out loud at this. “We can’t say we don’t sell your data because some places have definitions of “sell” that are legally difficult to interpret, for example”:

That was in California. Presumably, it's worded somewhat differently, and with different intent, elsewhere.

50 states, plus Federal laws, and all the other countries of the world and internal jurisdictions is how many possible variations? And before you say "Yeah, but they all mean mostly the same thing", remember it's lawyers we're dealing with, who will happily charge large sums of money arguing over misplaced punctuation and legislators who will happily take bribes from those same lawyers.

Most people here are assuming that they mentioned that one specifically because it was one of those that Mozilla feels is too broad or difficult. It could be simply read as a random example, but I think that's quite a generous interpretation.

California was the example they chose to provide. From this, we can reasonably infer that Mozilla does not have a better example handy to illustrate what's wrong with legal definitions around selling user's data. If their best example is completely unconvincing, we should remain unconvinced.

This binary is known to the State of California to sell data.

Getting $400M a year is not "commercially viable". But thanks for clearing this up that you want to sell my data. Switched to Waterfox (for now, hope for an independent fork) after 30+ years of Firefox.

There is no "independent fork," unless you consider the Chromium skins independent forks too.

"other valuable consideration" would be what I'd consider the "transfer" of personal data (DNS lookups, browsing behavior) Mozilla makes to Cloudflare by defaulting United States users to using DNS-over-https without notice.

This is the kind of clarification we need, the same way we need actual laws so that companies can't play with the definition of "purchase" to refer to what are actually rentals.

I was under the impression that selling anonymised data would also fall under this category. Either way we need more transparency here.

By that definition, wouldn’t sharing total monthly users for the basic purpose of landing some kind of deal (could be as simple as a partnership), constitute “selling data”? Stats like X million monthly users doesn’t appear to conflict with the spirit of the claim, but does conflict with that legal wording.

What part of "we have x million monthly users" is "a consumer’s personal information"? That's information about how many consumers you have, but it's not personal

My mistake, I missed that the data was limited to "personal" information.

But, "we have x million monthly users _in Arizona_" would be using your personal data, from a legal standpoint. And if they provide that aggregate data in exchange for money, they are selling your personal data (but not in the way many people think of it, like in a Google/FB sense of building an individualized profile and selling ads against that).

Mozilla might be doing very sketchy things with your data, but it's also very plausible that they are doing a reasonable job at anonymization of data but in a way that is still technically classified as selling personal data (in aggregate form).

I don’t think that’s true:

Per: https://thecpra.org/#1798.145(a)(6)

> Exemptions: > (6) Collect, use, retain, sell, share, or disclose consumers’ personal information that is deidentified or aggregate consumer information.

I understand that people who have a vested interest in eroding any possibility of online privacy and data protection would want us to believe these laws are vague and overreaching - but that doesn’t mean they actually are vague and overreaching.

I came here to quote the same sentence and ... yeah, they shouldn't be doing any of this stuff. It's an open source web browser. I type a URL into the URL bar, you send the domain name to my DNS server, then send the rest of the URL to whatever that resolves to, and then you render the content. At no point in this exchange is any oral communication or "valuable consideration" required.

Like sorry, if your selling point is "privacy" then you can't show ads on the new tab page. Debian was onto something when they called this software "IceWeasel".

I hate to point out the obvious, but when you collect and share with your partners, it’s obviously a polyamorous relationship. I’m appalled at this intrusion of California on the love life of companies.

Selling access to be the default search engine could count under this definition, which was Mozilla's primary revenue source for decades.

Wait, what? What part of this definition would include selling a default setting?

> selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information

Mozilla doesn't need my personal information at all to set a default search engine.

It rents making your personal data available.

Under a loose interpretation, which is what they expressed concern about.

So by that definition, if I click on your profile info here, HN is "selling me your data" no?

But anyway, if anyone thinks FF or any other browser can survive without such commercial deals needs to get ready to use Safari or other minor browser

> So by that definition, if I click on your profile info here, HN is "selling me your data" no?

What monetary or other valuable consideration does HN get from you when HN serves up someone's profile page to you?

Even if they did, I doubt it qualifies if the consumer intended to post it publicly. There's a difference between selling a book that I published versus selling access to a private draft of a book that I keep in cloud storage and never agreed to let you sell.

Reply on news.ycombinator.com