Hacker News Reader

Comment by braiamp | Hacker News Reader

This is yet again a nothing burger. They had to change that definition because in California "selling" means "[...] releasing, disclosing, disseminating, making available, transferring [...]" in exchange for “monetary” or *“other valuable consideration.”*. You can see user collected data publicly, and use said data to improve Firefox the browser, that would be argued that is a valuable consideration.

The user collected data are things like about:studies, the new tab page, Firefox Addons, and anything listed here https://www.mozilla.org/en-US/privacy/firefox/#health-report

This is literally language that had to change to describe Mozilla's actions in line with California's law.

View on HN

As was extensively discussed yesterday [0], their argument about why they had to change the terms actually makes things worse. They try to pass it off as "California has a bad definition of selling" but the definition of selling that they try to throw under the bus is just... common sense. If they're not compliant with California's definition of selling data, then they're selling data by most people's intuitive definition of selling data.

[0] https://news.ycombinator.com/item?id=43213612

If I tell you "hey, I need to collect data from your system, and said data will be shared with everyone else publicly in our bug tracker", how would a legal scholar read that wrt California law? BTW, layman arguing about legal definitions are not conclusions in matter of law.

I would not expect any software to share PII collected from my system in a public bug tracker.

Does the law differentiate between pii data or is it just any data?

GDPR does, but I was only pointing out that this scenario, as presented by my parent comment, is not normal:

> "hey, I need to collect data from your system, and said data will be shared with everyone else publicly in our bug tracker"

Mozilla isn't changing their terms of use because of anything relating to their bug tracker.

But to answer your irrelevant question, California law would probably not consider Mozilla putting user data on to Mozilla's public bug tracker to be a sale of user data because California's definition of "sale" requires Mozilla to be getting something of value in return, but Mozilla's public bug tracker is free for anyone to access.

The value isn't financial. Making their product better can be used as a something valuable that the organization gains.

As you said above, random commenters on the internet don't get to interpret the law. Who is the recipient of the data and who is giving the consideration under your framework? The wider internet? Random people on Bugzilla?

Consideration is the word used, and it has a specific meaning which involves a contract between two parties. I'm not at all sure how that can be mapped onto "using the data to improve our own product", and you're just vaguely insinuating that it might without any evidence.

https://www.law.cornell.edu/wex/consideration

use said data to improve Firefox the browser, that would be argued that is a valuable consideration.

Nice try but no.

A "sale" is a transaction between two legally distinct parties. Mozilla does not "sell" your data to itself and it does not "sell" your data to the public or to other users of Firefox either.

If Mozilla is concerned about the legal definition of "sell", there must be some other party involved. Wonder who that could be?

If so, their execution of that change is terrible. They could have explicitly clarified things, replacing "sell" with more expansive language that would maintain the explicit commitment to user privacy. But instead they changed their words to sound like Microsoft and Google, two notorious privacy violators, and have since only made it worse by only giving us circular explanations.

Unless they're running ads for other companies without taking any money, they are indeed selling data:

https://blog.mozilla.org/en/products/firefox/update-on-terms...

> In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners, including our optional ads on New Tab and providing sponsored suggestions in the search bar. We set all of this out in our Privacy Notice.

And that's what people are objecting to. The reason they need to clarify their terms "in accordance with California law" is because it is a good law, not because they have done nothing wrong.

That language is still there. They only collect data with your permission and that data is the only one that is being talked about in the changes.

> their execution of that change is terrible.

Maybe your response is what's terrible.

> You can see user collected data publicly

Where? I thought they were sharing this data with partners, not making it publicly available. See https://blog.mozilla.org/en/products/firefox/update-on-terms...:

Partners include people like you and me that work with them on specific experiments. Depending on the kind of data, for example Normandy [1] data, Nimbus [2] data are used on those experiments and help to develop and improve the product. Results of those specifically are usually private [3], but other telemetry are public [4] which also collects what could be considered PII.

[1]: https://mozilla.github.io/normandy/

[2]: https://experimenter.info/faq/general-faq

[3]: https://experimenter.info/results-availability

[4]: https://data.firefox.com/dashboard/hardware

That might be part of the data they share, but they also clearly said in the blog post I linked above that they also share some data with their ad partners.

> This is literally language that had to change to describe Mozilla's actions in line with California's law.

Am I missing something or does that law not apply to Mozilla giving Mozilla the data like you're implying?

Internal data transfer afaik doesn't matter. Using firefox collected data to improve firefox would amount to nothing, it's only when they give that data itself to a third party (in any ways shape or form as you said) that the law comes into effect.

The problem is that they also transfer that data and make it public [1] and also share with partners researchers for improving the software. Those two usages are selling according to California law, just because they can be argued as something that improves the product Firefox or Mozilla services.

[1]: https://data.firefox.com/dashboard/hardware

If you "share with partners" in exchange for money, that sounds a lot like selling.

Reply on news.ycombinator.com