Editing Mozilla introduces TOS to Firefox

{{Incomplete|Issue 1= This article is being written as this incident is ongoing so the severity of the incident is yet to be determined.}}
In February 2025 Mozilla introduced [[Terms of service|terms of use]] (TOS) for the Firefox browser for the first time as well as an updated {{wplink|Privacy policy|privacy policy}}. These terms of service contain a section about the rights and permissions the user gives to Mozilla. This has caused concern among Firefox users due to how this section was initially phrased.

==Background==
On February 26th 2025, Mozilla announced they were introducing terms of service and updating their privacy policy for the Firefox web browser. Until February 2025, Mozilla always relied on Firefox's open source license (the [https://www.mozilla.org/en-US/MPL/2.0/ Mozilla Public License version 2.0]) for the browser and their public commitments. They say that by adding these terms, they want to make their commitments "abundantly clear and accessible."<ref name="tos-announce">
{{cite web 
|first= Ajit
|last= Varma
|title= Introducing a terms of use and updated privacy notice for Firefox
|url= https://blog.mozilla.org/en/products/firefox/firefox-news/firefox-terms-of-use/
|website= Mozilla blog
|date=26 Feb 2025
|access-date=27 Feb 2025
|url-status=live
|archive-url=https://web.archive.org/web/20250227075559/https://blog.mozilla.org/en/products/firefox/firefox-news/firefox-terms-of-use/
|archive-date=27 Feb 2025
}}</ref>
However, concerns arose regarding whether Firefox itself, rather than just Mozilla's online services (such as Firefox Sync or Mozilla VPN), would be subject to the company's Acceptable Use Policy, which restricts certain types of content. Mozilla's Acceptable Use Policy includes prohibitions on graphic depictions of sexuality, violence, and hate speech, which are standard for services like Firefox Sync but were not previously associated with the Firefox browser itself. While Mozilla later removed references to the Acceptable Use Policy in a revision, this initial concern fueled distrust.<ref name="acceptable-use">
{{cite web 
|author=<!--not cited -->
|title= Acceptable Use Policy
|url=https://www.mozilla.org/en-US/about/legal/acceptable-use
|website= Mozilla 
|access-date=2 Mar 2025
|url-status=live
|archive-url=https://web.archive.org/web/20250228075344/https://www.mozilla.org/en-US/about/legal/acceptable-use/
|archive-date=28 Feb 2025
}}</ref>

==Questionable phrasing in the TOS and consumer response==
The new terms contained phrasing that has caused concern by users of Firefox and the reasoning for its inclusion in the privacy focused browser.<ref name="reddit-1">{{cite web 
|author=<!--not stated-->
|title= Introducing a terms of use and updated privacy notice for Firefox
|url= https://www.reddit.com/r/linux/comments/1iyzmo6/introducing_a_terms_of_use_and_updated_privacy/
|website= Reddit - r/linux
|date=26 Feb 2025
|access-date=27 Feb 2025
|url-status=live
}}</ref><ref name="discourse">{{cite web 
|author=<!--not stated-->
|title= Why does Mozilla now require a "nonexclusive, royalty-free, worldwide license" when entering information in Firefox?
|url= https://discourse.mozilla.org/t/why-does-mozilla-now-require-a-nonexclusive-royalty-free-worldwide-license-when-entering-information-in-firefox/140700
|website= Mozilla discourse 
|date=26 Feb 2025
|access-date=27 Feb 2025
|url-status=live
|archive-url=https://web.archive.org/web/20250227171303/https://discourse.mozilla.org/t/why-does-mozilla-now-require-a-nonexclusive-royalty-free-worldwide-license-when-entering-information-in-firefox/140700
|archive-date=27 Feb 2025
}}</ref><ref name="lemmy">
{{cite web 
|author=<!--not stated-->
|title= Mozilla Introducing 'Terms of Use' to Firefox
|url= https://lemmy.world/post/26091770
|website= Lemmy
|date=26 Feb 2025
|access-date=27 Feb 2025
|url-status=live
|archive-url=https://web.archive.org/web/20250227171252/https://lemmy.world/post/26091770
|archive-date=27 Feb 2025
}}</ref><ref name="moz-connect">
{{cite web 
|author=AshleyT
|title= Information about the New Terms of Use and Updated Privacy Notice for Firefox 
|url= https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privacy/m-p/87949/highlight/true#M33725
|website= Mozilla connect
|date=26 Feb 2025
|access-date=28 Feb 2025
|url-status=live
|archive-url=https://web.archive.org/web/20250228135428/https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privacy/m-p/87949/highlight/true#M33725
|archive-date=28 Feb 2025
}}</ref> Concerns center especially around the phrasing of terms outlined in the section titled "You Give Mozilla Certain Rights and Permissions".<ref name="TOS">
{{cite web 
|author=<!--not stated-->
|title= Firefox Terms of Use
|url=https://www.mozilla.org/en-US/about/legal/terms/firefox/
|website= Mozilla
|date=25 Feb 2025
|access-date=27 Feb 2025
|url-status=live
|archive-url=https://web.archive.org/web/20250227073459/https://www.mozilla.org/en-US/about/legal/terms/firefox/
|archive-date=27 Feb 2025
}}</ref> 

This is what that section originally said: 
<blockquote>
You give Mozilla all rights necessary to operate Firefox, including processing data as we describe in the Firefox Privacy Notice, as well as acting on your behalf to help you navigate the internet. When you upload or input information through Firefox, you hereby grant us a nonexclusive, royalty-free, worldwide license to use that information to help you navigate, experience, and interact with online content as you indicate with your use of Firefox.
</blockquote>
The vagueness of the terms resulted in users questioning how much of their data they were granting Mozilla a license to use, especially since the company puts a lot of emphasis on transparency and privacy on their manifesto.<ref name="manifesto">
{{cite web 
|author=<!--not stated-->
|title= The Mozilla Manifesto Addendum; Pledge for a Healthy Internet
|url=https://www.mozilla.org/en-US/about/manifesto/
|website= Mozilla
|date=25 Feb 2025
|access-date=27 Feb 2025
|url-status=live
|archive-url=https://web.archive.org/web/20250227045402/https://www.mozilla.org/en-US/about/manifesto/
|archive-date=27 Feb 2025
}}</ref> One notable concern is the possibility that license to user input could be used to train artificial intelligence tools. This became a concern since Mozilla has recently been working on AI tools.<ref name="orbit" />

===AI training concerns===

Mozilla's original TOU could have allowed AI training on user input. Mozilla's wording in their first round of TOS changes granted Mozilla a "nonexclusive, royalty-free, worldwide license" to "use" user input, without specifying clear limitations.<ref name="connect">{{cite web 
|title= Re: Information about the New Terms of Use and Updated Privacy Notice for Firefox
|url= https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privacy/m-p/87949/highlight/true
|website= Mozilla Connect
|date=27 Feb 2025
|access-date=1 Mar 2025
}}</ref> 
Mozillla's vague writing caused concern among Firefox users that their input could be used for artificial intelligence training, especially given Mozilla's AI-related projects.<ref name="orbit">{{cite web 
|title= Orbit by Mozilla
|url= https://orbitbymozilla.com/
|website= Mozilla AI
|access-date=1 Mar 2025
}}</ref> After backlash, Mozilla revised the TOU to clarify that data usage is restricted to user-requested actions.<ref name="tos-update">{{cite web 
|title= An update on our Terms of Use
|url= https://blog.mozilla.org/en/products/firefox/update-on-terms-of-use/
|website= Mozilla Blog
|date=28 Feb 2025
|access-date=1 Mar 2025
}}</ref>

===Date of effect===
It is also worth noting that the announcement of the introduction of the TOS and new privacy policy was made in a blog post one day after the terms and privacy policy are to take effect. No other communication was made to users of the browser as of February 27th 2025.

===Change of Firefox's FAQ===
[[File:Firefox faq.png|thumb|Firefox FAQ wording changes]]
Mozilla's Terms of Use no longer explicitly state that the company does not and will never sell user data. Previously, Mozilla's FAQ included the statement, "Nope. Never have, never will," when addressing whether they sell user data. The section promising not to sell personal data<ref name="faq-old">{{cite web 
|author=<!--not stated-->
|title= Firefox FAQ
|url= https://www.mozilla.org/en-US/firefox/faq/
|website= Mozilla
|access-date=28 Feb 2025
|url-status=live
|archive-url=https://web.archive.org/web/20250227214216/https://www.mozilla.org/en-US/firefox/faq/
|archive-date=27 Feb 2025
}}</ref> was quietly removed from their documentation.<ref name="github-tos">{{cite web 
|title= Tos copy updates (fix #16016) (#16018)
|url= https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e
|website= GitHub
|date=28 Feb 2025
|access-date=1 Mar 2025
}}</ref>

Before its removal, the section said:<blockquote>
''Does Firefox sell your personal data?''

''Nope. Never have, never will. And we protect you from many of the advertisers who do. Firefox products are designed to protect your privacy. That's a promise.''
</blockquote>
Another section Mozilla changed is removing part of the answer to the question "Is Firefox free?". This section concluded with the phrase "and we don't sell your personal data.".

Both of these were present in the FAQ until at least January 30th 2025.<ref name="faq">{{cite web 
|author=<!--not stated-->
|title= Firefox older FAQ 
|url= https://www.mozilla.org/en-US/firefox/faq/
|website= Mozilla
|url-status=dead
|archive-url=https://web.archive.org/web/20250130092351/https://www.mozilla.org/en-US/firefox/faq/
|archive-date=30 Jan 2025
}}</ref><ref name="github-faq">{{cite web 
|author=<!--not stated-->
|title= Github commit showing TOS FAQ changes
|url= https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e
|website= Github
|access-date= 1 Mar 2025
|url-status=live
}}</ref>

Mozilla justified this change by pointing to evolving legal definitions of "data selling," particularly under the California Consumer Privacy Act (CCPA), which defines "sale" broadly to include certain data-sharing arrangements. However, the revised Terms of Use do not explicitly prohibit Mozilla from selling user data in the future, leaving open the possibility of future monetization.<ref name="tos-update" />
Mozilla justified this by pointing to broad legal definitions under the California Consumer Privacy Act (CCPA), which define "selling data" as any transfer of data for "valuable consideration," even if anonymized.<ref name="ccpa">
{{cite web 
|title= CCPA Full Text
|url= https://www.osano.com/resources/ccpa
|website= Osano
|access-date=1 Mar 2025
}}</ref> However, the new Terms of Use do not explicitly prohibit Mozilla from selling user data in the future, meaning they could legally do so if they chose.<ref name="tos-update" />

==Mozilla's response==
[[File:Firefox-privacy-lawful-bases.png|thumb|Partial screenshot of the lawful basis section for data usage from the Firefox privacy policy.]]
Initially, Mozilla added an update to their initial blog post in an attempt to clarify the language of the terms of use.<ref name="tos-announce" /> 

This is what the update says: 
<blockquote>
'''UPDATE''': We've seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of the basic functionality of Firefox possible. Without it, we couldn't use information typed into Firefox, for example. It does NOT give us ownership of your data or a right to use it for anything other than what is described in the Privacy Notice.
</blockquote>
Notably, this update doesn't address the concerns relating to the broadness that can be attributed to the wording of the terms.

Mozilla's privacy policy contains fairly extensive and clear statements on how Mozilla uses user data. It does not explicitly mention artificial intelligence tools other than the ability to use third party chat assistants. The privacy policy clarifies that Mozilla has no access to these chats.

On February 28th, Mozilla updated the terms of use to address the concerns people were having. The section about rights and permissions given to Mozilla was reworded to be more clear:<blockquote>You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content.</blockquote>As well as this, the new terms have removed the reference to the acceptable use policy.

Mozilla have also provided an explanation for why they changed their FAQ.<ref name="tos-update" /> They say this is because different legislation has different definitions of "sale of data" and this makes it uncertain on whether a business is legally considered to be selling data. Mozilla explicitly cites the California Consumer Privacy Act<ref name="ccpa" /> with regards to how existing privacy legislation defines the sale of data. 

==Mozilla's Business Model & Potential CCPA Violations==
Before the Terms of Use update, Mozilla publicly stated that it did not & would never sell user data. However, under the California Consumer Privacy Act (CCPA), some of Mozilla's existing business practices may have legally qualified as "selling data." While there is no confirmed evidence that Mozilla violated the CCPA, their data-sharing practices placed them in a legally gray area.

===Potential CCPA Compliance Issues Before the TOU Update===
The CCPA defines "selling data" as: <blockquote>
'' “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.''<ref name="ccpa" />
</blockquote> 

*'''Search Engine Partnerships (Google, Bing, Yandex, etc.)''': Mozilla's largest revenue source comes from deals with search engines like Google, which pay Mozilla to be Firefox's default search provider.<ref>{{cite web 
|title= Mozilla Foundation and Subsidiaries ; Independent Auditors’ Report, and Consolidated Financial Statement
|url= https://assets.mozilla.net/annualreport/2022/mozilla-fdn-2022-fs-final-0908.pdf
|website= Mozilla
|access-date=2 Mar 2025
|url-status=live
|archive-url=https://web.archive.org/web/20250211174819/https://assets.mozilla.net/annualreport/2022/mozilla-fdn-2022-fs-final-0908.pdf
|archive-date=11 Feb 2025
}}. [[:File:Mozilla-fdn-2022-fs-final-0908.pdf|See file on the wiki]] 
</ref>
These deals involve sending search query data to search partners. Under the CCPA, if Mozilla transmitted search data in exchange for financial compensation, this could be classified as a ''"sale of data."'' This is a practice that Mozilla had already been openly taking part in.

===Mozilla's Sponsored Ads & Potential CCPA Implications===

====How Mozilla’s Sponsored Ads Work====
Mozilla monetizes Firefox through advertising programs:
*'''Pocket Sponsored Stories''': Mozilla owns Pocket, which provides content recommendations. Mozilla shares aggregated data with ad platforms (such as Adzerk) so advertisers can track engagement.<ref name="pocket-sponsored">
{{cite web 
|title= Pocket Sponsored Stories on New Tabs
|url= https://support.mozilla.org/kb/pocket-sponsored-stories-new-tabs
|website= Mozilla Support
|access-date=2 Mar 2025
}}</ref>

*'''Sponsored Shortcuts''': Mozilla displays paid website shortcuts on the New Tab page. Mozilla gets paid per user click & routes click data through a Mozilla-owned proxy service.<ref name="sponsored-shortcuts">
{{cite web 
|title= Sponsored Shortcuts on the New Tab Page
|url= https://support.mozilla.org/kb/sponsored-shortcuts-new-tab
|website= Mozilla Support
|access-date=2 Mar 2025
}}</ref>

*'''Sponsored Suggestions in Search''': Mozilla processes search queries & shares de-identified interaction data with partners, including search engines and ad networks.<ref name="firefox-privacy" />

Mozilla says all data shared with advertisers is anonymized, aggregated, or de-identified before being disclosed.

====How this relates to Mozilla’s Privacy Policy====
Mozilla’s Privacy Policy states that user data is only shared in an aggregated or de-identified form.<ref name="mozilla-privacy">{{cite web 
|title= Mozilla Privacy Policy
|url= https://www.mozilla.org/en-US/privacy/
|website= Mozilla
|access-date=2 Mar 2025
}}</ref> The Firefox Privacy Notice also confirms:<blockquote>''Mozilla processes interaction data (such as ad clicks) & shares de-identified information with partners. Partners cannot associate these interactions with an individual user.<ref name="firefox-privacy" />''</blockquote>This lines up with Mozilla's claim that it does not sell personal data under the CCPA.

====Potential CCPA Compliance Issues====

Mozilla's ad system does not clearly violate the CCPA, but it exists in a gray area because of:
*'''Valuable Consideration Clause''': Mozilla earns money from clicks on Sponsored Shortcuts, which may be considered a sale under the CCPA if user data has "value."

*'''Lack of a Clear "Do Not Sell" Option''': The CCPA requires an explicit "Do Not Sell My Data" button, but Mozilla bundles opt-out settings under "technical and interaction data." Mozilla's privacy policy page states ''"You can opt out of having your data processed for personalization or advertising purposes by turning off “technical and interaction data” on Desktop and Mobile at any time".''<ref name="firefox-privacy" /> Firefox does have this option in the privacy and security section of the settings as of version 135 (4th February 2025).<ref>https://support.mozilla.org/en-US/kb/how-do-i-turn-do-not-track-feature?as=u&utm_source=inproduct</ref>

*'''Potential Re-identification of Data''': CCPA states that anonymized data can still be personal information if it can be linked to a user.<ref name="ccpa" />

While Mozilla tells users that advertisers cannot directly identify users, regulators may argue that user interactions still hold monetary value, which could require Mozilla to revise its privacy policy for full compliance.

===Legitimate Reasons for Mozilla Updating Its Terms of Use===
Mozilla's sudden change to its Terms of Use & Privacy Policy can be viewed as hedges to Mozilla's legal risks & exposure under the California Consumer Privacy Act (CCPA), rather than an admission of wrongdoing.

*'''Legal Definitions of "Selling Data" Under the CCPA Are Broad''': As noted above, the CCPA's definition encompasses many data-sharing practices that may not align with common understanding of "selling data".<ref name="ccpa" /> Even if Mozilla was not directly selling user data, its search partnerships, telemetry data sharing, & sponsored content could have been interpreted as data sales if Mozilla received any financial benefit from them, all of which were actions that Mozilla has already been transparent & upfront about.

*'''Mozilla's Search Engine Deals Could Be Considered Data Sales''': As mentioned earlier, these partnerships could legally qualify as data sales under the CCPA definition, despite being an existing part of Mozilla's business model that consumers are already aware of.<ref name="tos-announce" />

*'''Sponsored Content in Firefox's New Tab Page Involves Data Exchange''': Mozilla displays sponsored content and ads on the Firefox New Tab page, which may involve user interaction data being shared with advertisers.<ref name="tos-update" /> Even if the data is anonymized, the CCPA considers certain types of aggregated data as personal information if it can be linked back to users.<ref name="ccpa" />

By removing explicit guarantees such as "we never sell your data" & rewriting the Terms of Use, Mozilla eliminated legal ambiguity while maintaining its existing business model.  

While the new terms of use does not confirm that Mozilla intends to sell user data, & puts its current practices in-line with California's Consumer Privacy Act, it no longer explicitly prohibits it, leaving open the possibility for future monetization.

==Community Concerns & Digging into the validity of them==
Mozilla's Terms of Use & Privacy Policy update led to loud public protest over them. Here is an analysis of the primary concerns raised by the Firefox community:

===Valid Concerns===
====Vague licensing language in the TOU====
Initially, Mozilla's TOU granted the company a "nonexclusive, royalty-free, worldwide license" to user input, which raised concerns about potential data ownership and usage rights.<ref name="connect">{{cite web 
|title= Re: Information about the New Terms of Use and Updated Privacy Notice for Firefox
|url= https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privacy/m-p/87949/highlight/true
|website= Mozilla Connect
|date=27 Feb 2025
|access-date=1 Mar 2025
}}</ref> This was later revised after backlash.<ref name="tos-update" />

====Mozilla removed explicit language about not selling user data====
Mozilla's FAQ previously stated, "We don't and never will sell your personal data," but this was quietly removed from its website and documentation.<ref name="github-tos">{{cite web 
|title= Tos copy updates (fix #16016) (#16018)
|url= https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e
|website= GitHub
|date=28 Feb 2025
|access-date=1 Mar 2025
}}</ref> Mozilla later stated that different legal jurisdictions, such as the California Consumer Privacy Act (CCPA), had vague definitions of "data selling," which led them to revise this wording.<ref name="tos-update" />

====Users were not notified before the TOU changes took effect====
Mozilla announced the new terms on February 26, 2025, but they had already taken effect by February 25, 2025.<ref name="tos-announce" />

====Lack of clarity on why Mozilla needs a license to user input====
Users questioned why Mozilla needed licensing rights over user input when browsers have worked for 25+ years without these terms.<ref name="connect" />
While the new TOU does not confirm that Mozilla intends to sell user data, it no longer explicitly prohibits it, leaving open the possibility for future monetization.

===Concerns Likely Based on Misinterpretation===
====Mozilla will log & track all user browsing data====
Some users assumed the TOU granted Mozilla unlimited access to browsing history.<ref name="connect" /> However, Mozilla's privacy policy still states that it does not store user browsing history or personal data beyond necessary telemetry.<ref name="tos-announce" />

====Mozilla's telemetry data collection doesn't seem to constitute a "sale" under the CCPA====
Firefox collects telemetry data by default, including interaction metrics (such as the number of open tabs, visited webpages, & search partner referrals) & technical data (such as OS version, hardware specs, and crash reports).<ref name="telemetry">{{cite web 
|title= Telemetry collection and deletion
|url= https://support.mozilla.org/en-US/kb/telemetry-clientid
|website= Mozilla Support
|access-date=1 Mar 2025
}}</ref> However, Mozilla clearly says that this data is only sent to Mozilla & does not explicitly mention sharing this with third parties<ref name="firefox-privacy">{{cite web 
|title= Firefox Privacy Notice
|url= https://www.mozilla.org/en-US/privacy/firefox/#notice
|website= Mozilla
|access-date=1 Mar 2025
}}</ref> Under the California Consumer Privacy Act (CCPA), a "sale" requires data to be transferred to a third party in exchange for monetary or other valuable consideration.<ref name="ccpa" />
Since Mozilla does not explicitly transfer telemetry data to third parties, it is unlikely to be classified as a "sale" under the CCPA. Users can opt out of telemetry data collection, and Mozilla deletes previously collected data within 30 days of opting out.<ref name="telemetry" />

Mozilla tried to clarify where they stand on data privacy, but the way they've written their terms as well as the manner in which they communicated them has resulted in user protest & distrust. 

==See also==
*[[Mozilla]]
*[https://youtu.be/AyjiOBWH91s Is LibreWolf and EVERY FIREFOX FORK now COMPROMISED?]

==References==

[[Category:Incidents]]
[[Category:Mozilla]]
<references />