Mozilla introduces TOS to Firefox: Difference between revisions
minor clarifications Tag: 2017 source edit |
mozilla's original terms didn't prohibit data sales, they simply said they wouldn't do it. pedantic difference. :( also fixed some formatting errors. Tag: 2017 source edit |
||
| Line 2: | Line 2: | ||
In February 2025 Mozilla introduced [[Terms of service|terms of use]] (TOS) for the Firefox browser for the first time as well as an updated {{wplink|Privacy policy|privacy policy}}. These terms of service contain a section about the rights and permissions the user gives to Mozilla. This has caused concern among Firefox users due to how this section was initially phrased. | In February 2025 Mozilla introduced [[Terms of service|terms of use]] (TOS) for the Firefox browser for the first time as well as an updated {{wplink|Privacy policy|privacy policy}}. These terms of service contain a section about the rights and permissions the user gives to Mozilla. This has caused concern among Firefox users due to how this section was initially phrased. | ||
==Background== | ==Background== | ||
On February 26th 2025, Mozilla announced they were introducing terms of service and updating their privacy policy for the Firefox web browser. Until February 2025, Mozilla always relied on Firefox's open source license (the [https://www.mozilla.org/en-US/MPL/2.0/ Mozilla Public License version 2.0]) for the browser and their public commitments. They say that by adding these terms, they want to make their commitments "abundantly clear and accessible".<ref name="tos-announce"> | On February 26th 2025, Mozilla announced they were introducing terms of service and updating their privacy policy for the Firefox web browser. Until February 2025, Mozilla always relied on Firefox's open source license (the [https://www.mozilla.org/en-US/MPL/2.0/ Mozilla Public License version 2.0]) for the browser and their public commitments. They say that by adding these terms, they want to make their commitments "abundantly clear and accessible." However, concerns arose regarding whether Firefox itself, rather than just Mozilla's online services (such as Firefox Sync or Mozilla VPN), would be subject to the company's '''Acceptable Use Policy''', which restricts certain types of content.<ref name="tos-announce"> Mozilla's Acceptable Use Policy includes prohibitions on graphic depictions of sexuality, violence, and hate speech, which are standard for services like Firefox Sync but were not previously associated with the Firefox browser itself. While Mozilla later removed references to the Acceptable Use Policy in a revision, this initial concern fueled distrust. | ||
{{cite web | {{cite web | ||
|first= Ajit | |first= Ajit | ||
| Line 27: | Line 28: | ||
}}</ref><ref name="discourse">{{cite web | }}</ref><ref name="discourse">{{cite web | ||
|author=<!--not stated--> | |author=<!--not stated--> | ||
|title= Why does Mozilla now require a | |title= Why does Mozilla now require a "nonexclusive, royalty-free, worldwide license" when entering information in Firefox? | ||
|url= https://discourse.mozilla.org/t/why-does-mozilla-now-require-a-nonexclusive-royalty-free-worldwide-license-when-entering-information-in-firefox/140700 | |url= https://discourse.mozilla.org/t/why-does-mozilla-now-require-a-nonexclusive-royalty-free-worldwide-license-when-entering-information-in-firefox/140700 | ||
|website= Mozilla discourse | |website= Mozilla discourse | ||
| Line 89: | Line 90: | ||
===AI training concerns=== | ===AI training concerns=== | ||
*''' | *'''Mozilla's original TOU could have allowed AI training on user input''': Mozilla's wording in their first round of TOS changes granted Mozilla a "nonexclusive, royalty-free, worldwide license" to "use" user input, without specifying clear limitations.<ref name="connect">{{cite web | ||
|title= Re: Information about the New Terms of Use and Updated Privacy Notice for Firefox | |title= Re: Information about the New Terms of Use and Updated Privacy Notice for Firefox | ||
|url= https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privacy/m-p/87949/highlight/true | |url= https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privacy/m-p/87949/highlight/true | ||
| Line 95: | Line 96: | ||
|date=27 Feb 2025 | |date=27 Feb 2025 | ||
|access-date=1 Mar 2025 | |access-date=1 Mar 2025 | ||
}}</ref> Mozillla's vague writing caused concern among firefox users that their input could be used for artificial intelligence training, especially given | }}</ref> Mozillla's vague writing caused concern among firefox users that their input could be used for artificial intelligence training, especially given Mozilla's AI-related projects.<ref name="orbit">{{cite web | ||
|title= Orbit by Mozilla | |title= Orbit by Mozilla | ||
|url= https://orbitbymozilla.com/ | |url= https://orbitbymozilla.com/ | ||
| Line 107: | Line 108: | ||
|access-date=1 Mar 2025 | |access-date=1 Mar 2025 | ||
}}</ref> | }}</ref> | ||
===Date of effect=== | ===Date of effect=== | ||
It is also worth noting that the announcement of the introduction of the TOS and new privacy policy was made in a blog post one day after the terms and privacy policy are to take effect. No other communication was made to users of the browser as of February 27th 2025. | It is also worth noting that the announcement of the introduction of the TOS and new privacy policy was made in a blog post one day after the terms and privacy policy are to take effect. No other communication was made to users of the browser as of February 27th 2025. | ||
===Change of Firefox's FAQ=== | ===Change of Firefox's FAQ=== | ||
[[File:Firefox-faq.png|thumb|Firefox FAQ wording changes, new left old right.]] | [[File:Firefox-faq.png|thumb|Firefox FAQ wording changes, new left old right.]] | ||
| Line 124: | Line 127: | ||
Before its removal, this is what the section said:<blockquote>''Does Firefox sell your personal data?'' | Before its removal, this is what the section said:<blockquote>''Does Firefox sell your personal data?'' | ||
''Nope. Never have, never will. And we protect you from many of the advertisers who do. Firefox products are designed to protect your privacy. | ''Nope. Never have, never will. And we protect you from many of the advertisers who do. Firefox products are designed to protect your privacy. That's a promise.''</blockquote>Another section Mozilla changed is removing part of the answer to the question "Is Firefox free?". This section concluded with the phrase "and we don't sell your personal data.". This section has since been removed. | ||
Both of these were present in the FAQ until at least January 30th 2025.<ref name="faq">{{cite web | Both of these were present in the FAQ until at least January 30th 2025.<ref name="faq">{{cite web | ||
| Line 143: | Line 146: | ||
}}</ref> | }}</ref> | ||
*''' | *'''Mozilla's Terms of Use no longer explicitly state that the company does not and will never sell user data.''' Previously, Mozilla's FAQ included the statement, "Nope. Never have, never will," when addressing whether they sell user data. This statement was quietly removed from their documentation.<ref name="github-tos">{{cite web | ||
|title= Tos copy updates (fix #16016) (#16018) | |title= Tos copy updates (fix #16016) (#16018) | ||
|url= https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e | |url= https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e | ||
| Line 149: | Line 152: | ||
|date=28 Feb 2025 | |date=28 Feb 2025 | ||
|access-date=1 Mar 2025 | |access-date=1 Mar 2025 | ||
}}</ref> Mozilla justified this by pointing to broad legal definitions under the California Consumer Privacy Act (CCPA), which define "selling data" as any transfer of data for "valuable consideration," even if anonymized.<ref name="ccpa">{{cite web | }}</ref> Mozilla justified this change by pointing to evolving legal definitions of "data selling," particularly under the '''California Consumer Privacy Act (CCPA)''', which defines "sale" broadly to include certain data-sharing arrangements. However, the '''revised Terms of Use do not explicitly prohibit Mozilla from selling user data in the future, leaving open the possibility of future monetization'''.<ref name="tos-update">{{cite web | ||
|title= An update on our Terms of Use | |||
|url= https://blog.mozilla.org/en/products/firefox/update-on-terms-of-use/ | |||
|website= Mozilla Blog | |||
|date=28 Feb 2025 | |||
|access-date=1 Mar 2025 | |||
}}</ref> | |||
Mozilla justified this by pointing to broad legal definitions under the California Consumer Privacy Act (CCPA), which define "selling data" as any transfer of data for "valuable consideration," even if anonymized.<ref name="ccpa">{{cite web | |||
|title= CCPA Full Text | |title= CCPA Full Text | ||
|url= https://www.osano.com/resources/ccpa | |url= https://www.osano.com/resources/ccpa | ||
| Line 161: | Line 172: | ||
|access-date=1 Mar 2025 | |access-date=1 Mar 2025 | ||
}}</ref> | }}</ref> | ||
==Mozilla's response== | ==Mozilla's response== | ||
[[File:Firefox-privacy-lawful-bases.png|thumb|Partial screenshot of lawful basis section for data usage from the Firefox privacy policy.]] | [[File:Firefox-privacy-lawful-bases.png|thumb|Partial screenshot of lawful basis section for data usage from the Firefox privacy policy.]] | ||
| Line 167: | Line 179: | ||
This is what the update says: | This is what the update says: | ||
<blockquote> | <blockquote> | ||
'''UPDATE''': | '''UPDATE''': We've seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of the basic functionality of Firefox possible. Without it, we couldn't use information typed into Firefox, for example. It does NOT give us ownership of your data or a right to use it for anything other than what is described in the Privacy Notice. | ||
</blockquote> | </blockquote> | ||
Notably, this update doesn't address the concerns relating to the broadness that can be attributed to the wording of the terms. | Notably, this update doesn't address the concerns relating to the broadness that can be attributed to the wording of the terms. | ||
| Line 177: | Line 189: | ||
Mozilla have also provided explanation for why they changed their FAQ.<ref>https://blog.mozilla.org/en/products/firefox/update-on-terms-of-use/</ref> They say this is because different legislation has different definitions of "sale of data" and this makes it uncertain on whether a business is legally considered to be selling data. Mozilla explicitly cites the California Consumer Privacy Act<ref>https://www.osano.com/ccpa</ref> with regards to how existing privacy legislation defines the sale of data. | Mozilla have also provided explanation for why they changed their FAQ.<ref>https://blog.mozilla.org/en/products/firefox/update-on-terms-of-use/</ref> They say this is because different legislation has different definitions of "sale of data" and this makes it uncertain on whether a business is legally considered to be selling data. Mozilla explicitly cites the California Consumer Privacy Act<ref>https://www.osano.com/ccpa</ref> with regards to how existing privacy legislation defines the sale of data. | ||
== | ==Mozilla's Business Model & Potential CCPA Violations== | ||
Before the Terms of Use update, Mozilla publicly stated that it did not & would never sell user data. '''However, under the California Consumer Privacy Act (CCPA), some of | Before the Terms of Use update, Mozilla publicly stated that it did not & would never sell user data. '''However, under the California Consumer Privacy Act (CCPA), some of Mozilla's existing business practices may have legally qualified as "selling data."''' While there is no confirmed evidence that Mozilla violated the CCPA, their data-sharing practices placed them in a legally gray area. | ||
===Potential CCPA Compliance Issues Before the TOU Update=== | ===Potential CCPA Compliance Issues Before the TOU Update=== | ||
The CCPA defines "selling data" as: <blockquote>''Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a | The CCPA defines "selling data" as: <blockquote>''Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration.''<ref name="ccpa">{{cite web | ||
|title= CCPA Full Text | |title= CCPA Full Text | ||
|url= https://www.osano.com/resources/ccpa | |url= https://www.osano.com/resources/ccpa | ||
| Line 188: | Line 200: | ||
}}</ref></blockquote> | }}</ref></blockquote> | ||
*'''Search Engine Partnerships (Google, Bing, Yandex, etc.)''': Mozilla's largest revenue source comes from deals with search engines like Google, which pay Mozilla to be Firefox's default search provider.<ref>https://assets.mozilla.net/annualreport/2022/mozilla-fdn-2022-fs-final-0908.pdf</ref><ref>[[:File:Mozilla-fdn-2022-fs-final-0908.pdf]]</ref> These deals involve sending search query data to search partners. Under the CCPA, if Mozilla transmitted search data in exchange for financial compensation, this could be classified as a ''"sale of data."'' '''This is a practice that Mozilla had already been openly taking part in.''' | |||
*'''Sponsored Content & Ads in the New Tab Page''': Mozilla's New Tab page displays sponsored content and ads, which involve user interaction data being shared with third-party ad networks.<ref name="tos-update">{{cite web | |||
*'''Sponsored Content & Ads in the New Tab Page''': | |||
|title= An update on our Terms of Use | |title= An update on our Terms of Use | ||
|url= https://blog.mozilla.org/en/products/firefox/update-on-terms-of-use/ | |url= https://blog.mozilla.org/en/products/firefox/update-on-terms-of-use/ | ||
| Line 197: | Line 208: | ||
|date=28 Feb 2025 | |date=28 Feb 2025 | ||
|access-date=1 Mar 2025 | |access-date=1 Mar 2025 | ||
}}</ref> Even if anonymized, the CCPA states that aggregated data can still be classified as personal data if it can be linked back to a user.<ref name="ccpa" /> | }}</ref> Even if anonymized, the CCPA states that aggregated data can still be classified as personal data if it can be linked back to a user.<ref name="ccpa" /> | ||
===Legitimate Reasons for Mozilla Updating Its Terms of Use=== | ===Legitimate Reasons for Mozilla Updating Its Terms of Use=== | ||
Mozilla's sudden change to its Terms of Use & Privacy Policy can be viewed as hedges to Mozilla's legal risks & exposure under the California Consumer Privacy Act (CCPA), rather than an admission of wrongdoing. | |||
*'''Legal Definitions of "Selling Data" Under the CCPA Are Broad''': As noted above, the CCPA's definition encompasses many data-sharing practices that may not align with common understanding of "selling data".<ref name="ccpa" /> Even if Mozilla was not directly selling user data, its search partnerships, telemetry data sharing, & sponsored content could have been interpreted as data sales if Mozilla received any financial benefit from them, '''all of which were actions that Mozilla has already been transparent & upfront about''' | *'''Legal Definitions of "Selling Data" Under the CCPA Are Broad''': As noted above, the CCPA's definition encompasses many data-sharing practices that may not align with common understanding of "selling data".<ref name="ccpa" /> Even if Mozilla was not directly selling user data, its search partnerships, telemetry data sharing, & sponsored content could have been interpreted as data sales if Mozilla received any financial benefit from them, '''all of which were actions that Mozilla has already been transparent & upfront about''' | ||
| Line 205: | Line 217: | ||
*'''Mozilla's Search Engine Deals Could Be Considered Data Sales''': As mentioned earlier, these partnerships could legally qualify as data sales under the CCPA definition, despite being an existing part of Mozilla's business model that consumers are already aware of.<ref name="tos-announce" /> | *'''Mozilla's Search Engine Deals Could Be Considered Data Sales''': As mentioned earlier, these partnerships could legally qualify as data sales under the CCPA definition, despite being an existing part of Mozilla's business model that consumers are already aware of.<ref name="tos-announce" /> | ||
*'''Sponsored Content in | *'''Sponsored Content in Firefox's New Tab Page Involves Data Exchange''': Mozilla displays sponsored content and ads on the Firefox New Tab page, which may involve user interaction data being shared with advertisers.<ref name="tos-update">{{cite web | ||
|title= An update on our Terms of Use | |title= An update on our Terms of Use | ||
|url= https://blog.mozilla.org/en/products/firefox/update-on-terms-of-use/ | |url= https://blog.mozilla.org/en/products/firefox/update-on-terms-of-use/ | ||
| Line 218: | Line 230: | ||
==Community Concerns & Digging into the validity of them== | ==Community Concerns & Digging into the validity of them== | ||
Mozilla's Terms of Use & Privacy Policy update led to loud public protest over them. Here is an analysis of the primary concerns raised by the Firefox community: | |||
===Valid Concerns=== | ===Valid Concerns=== | ||
*'''Vague licensing language in the TOU''': Initially, | *'''Vague licensing language in the TOU''': Initially, Mozilla's TOU granted the company a "nonexclusive, royalty-free, worldwide license" to user input, which raised concerns about potential data ownership and usage rights.<ref name="connect">{{cite web | ||
|title= Re: Information about the New Terms of Use and Updated Privacy Notice for Firefox | |title= Re: Information about the New Terms of Use and Updated Privacy Notice for Firefox | ||
|url= https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privacy/m-p/87949/highlight/true | |url= https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privacy/m-p/87949/highlight/true | ||
| Line 235: | Line 247: | ||
}}</ref> | }}</ref> | ||
*'''Mozilla removed explicit language about not selling user data''': | *'''Mozilla removed explicit language about not selling user data''': Mozilla's FAQ previously stated, "We don't and never will sell your personal data," but this was quietly removed from its website and documentation.<ref name="github-tos">{{cite web | ||
|title= Tos copy updates (fix #16016) (#16018) | |title= Tos copy updates (fix #16016) (#16018) | ||
|url= https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e | |url= https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e | ||
| Line 255: | Line 267: | ||
===Concerns Likely Based on Misinterpretation=== | ===Concerns Likely Based on Misinterpretation=== | ||
*'''Mozilla will log & track all user browsing data''': Some users assumed the TOU granted Mozilla unlimited access to browsing history.<ref name="connect" /> However, | *'''Mozilla will log & track all user browsing data''': Some users assumed the TOU granted Mozilla unlimited access to browsing history.<ref name="connect" /> However, Mozilla's privacy policy still states that it does not store user browsing history or personal data beyond necessary telemetry.<ref name="tos-announce" /> | ||
*''' | *'''Mozilla's telemetry data collection doesn't seem to constitute a "sale" under the CCPA''': Firefox collects telemetry data by default, including interaction metrics (such as the number of open tabs, visited webpages, & search partner referrals) & technical data (such as OS version, hardware specs, and crash reports).<ref name="telemetry">{{cite web | ||
|title= Telemetry collection and deletion | Firefox Help | |title= Telemetry collection and deletion | Firefox Help | ||
|url= https://support.mozilla.org/en-US/kb/telemetry-clientid | |url= https://support.mozilla.org/en-US/kb/telemetry-clientid | ||
| Line 275: | Line 287: | ||
Mozilla tried to clarify where they stand on data privacy, but the way they've written their terms as well as the manner in which they communicated them has resulted in user protest & distrust. | Mozilla tried to clarify where they stand on data privacy, but the way they've written their terms as well as the manner in which they communicated them has resulted in user protest & distrust. | ||
==See also== | ==See also== | ||