Mozilla introduces TOS to Firefox: Difference between revisions

m add haphazard mention of do not sell feature. Not sure if section is regarding mozilla as a whole
Removed an extra period and a redundant "this is what".
Tags: Mobile edit Mobile web edit Visual edit
Line 97: Line 97:
|archive-url=https://web.archive.org/web/20250227045402/https://www.mozilla.org/en-US/about/manifesto/
|archive-url=https://web.archive.org/web/20250227045402/https://www.mozilla.org/en-US/about/manifesto/
|archive-date=27 Feb 2025
|archive-date=27 Feb 2025
}}</ref> One notable concern is the possibility that license to user input could be used to train artificial intelligence tools. This became a concern since Mozilla has recently been working on AI tools.<ref name="orbit"/>
}}</ref> One notable concern is the possibility that license to user input could be used to train artificial intelligence tools. This became a concern since Mozilla has recently been working on AI tools.<ref name="orbit" />


===AI training concerns===
===AI training concerns===
Line 126: Line 126:
===Change of Firefox's FAQ===
===Change of Firefox's FAQ===
[[File:Firefox faq.png|thumb|Firefox FAQ wording changes]]
[[File:Firefox faq.png|thumb|Firefox FAQ wording changes]]
Mozilla's Terms of Use no longer explicitly state that the company does not and will never sell user data. Previously, Mozilla's FAQ included the statement, "Nope. Never have, never will," when addressing whether they sell user data. The section promising not to sell personal data.<ref name="faq-old">{{cite web  
Mozilla's Terms of Use no longer explicitly state that the company does not and will never sell user data. Previously, Mozilla's FAQ included the statement, "Nope. Never have, never will," when addressing whether they sell user data. The section promising not to sell personal data<ref name="faq-old">{{cite web  
|author=<!--not stated-->
|author=<!--not stated-->
|title= Firefox FAQ
|title= Firefox FAQ
Line 135: Line 135:
|archive-url=https://web.archive.org/web/20250227214216/https://www.mozilla.org/en-US/firefox/faq/
|archive-url=https://web.archive.org/web/20250227214216/https://www.mozilla.org/en-US/firefox/faq/
|archive-date=27 Feb 2025
|archive-date=27 Feb 2025
}}</ref>was quietly removed from their documentation.<ref name="github-tos">{{cite web  
}}</ref> was quietly removed from their documentation.<ref name="github-tos">{{cite web  
|title= Tos copy updates (fix #16016) (#16018)
|title= Tos copy updates (fix #16016) (#16018)
|url= https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e
|url= https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e
Line 143: Line 143:
}}</ref>
}}</ref>


Before its removal, this is what the section said:<blockquote>
Before its removal, the section said:<blockquote>
''Does Firefox sell your personal data?''
''Does Firefox sell your personal data?''


Line 167: Line 167:
}}</ref>
}}</ref>


Mozilla justified this change by pointing to evolving legal definitions of "data selling," particularly under the California Consumer Privacy Act (CCPA), which defines "sale" broadly to include certain data-sharing arrangements. However, the revised Terms of Use do not explicitly prohibit Mozilla from selling user data in the future, leaving open the possibility of future monetization.<ref name="tos-update"/>
Mozilla justified this change by pointing to evolving legal definitions of "data selling," particularly under the California Consumer Privacy Act (CCPA), which defines "sale" broadly to include certain data-sharing arrangements. However, the revised Terms of Use do not explicitly prohibit Mozilla from selling user data in the future, leaving open the possibility of future monetization.<ref name="tos-update" />
Mozilla justified this by pointing to broad legal definitions under the California Consumer Privacy Act (CCPA), which define "selling data" as any transfer of data for "valuable consideration," even if anonymized.<ref name="ccpa">
Mozilla justified this by pointing to broad legal definitions under the California Consumer Privacy Act (CCPA), which define "selling data" as any transfer of data for "valuable consideration," even if anonymized.<ref name="ccpa">
{{cite web  
{{cite web  
Line 174: Line 174:
|website= Osano
|website= Osano
|access-date=1 Mar 2025
|access-date=1 Mar 2025
}}</ref> However, the new Terms of Use do not explicitly prohibit Mozilla from selling user data in the future, meaning they could legally do so if they chose.<ref name="tos-update"/>
}}</ref> However, the new Terms of Use do not explicitly prohibit Mozilla from selling user data in the future, meaning they could legally do so if they chose.<ref name="tos-update" />


==Mozilla's response==
==Mozilla's response==
Line 190: Line 190:
On February 28th, Mozilla updated the terms of use to address the concerns people were having.The section about rights and permissions given to Mozilla was reworded to be more clear:<blockquote>You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content.</blockquote>As well as this, the new terms have removed the reference to the acceptable use policy.
On February 28th, Mozilla updated the terms of use to address the concerns people were having.The section about rights and permissions given to Mozilla was reworded to be more clear:<blockquote>You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content.</blockquote>As well as this, the new terms have removed the reference to the acceptable use policy.


Mozilla have also provided explanation for why they changed their FAQ.<ref name="tos-update"/> They say this is because different legislation has different definitions of "sale of data" and this makes it uncertain on whether a business is legally considered to be selling data. Mozilla explicitly cites the California Consumer Privacy Act<ref name="ccpa"/> with regards to how existing privacy legislation defines the sale of data.  
Mozilla have also provided explanation for why they changed their FAQ.<ref name="tos-update" /> They say this is because different legislation has different definitions of "sale of data" and this makes it uncertain on whether a business is legally considered to be selling data. Mozilla explicitly cites the California Consumer Privacy Act<ref name="ccpa" /> with regards to how existing privacy legislation defines the sale of data.  


==Mozilla's Business Model & Potential CCPA Violations==
==Mozilla's Business Model & Potential CCPA Violations==
Line 197: Line 197:
===Potential CCPA Compliance Issues Before the TOU Update===
===Potential CCPA Compliance Issues Before the TOU Update===
The CCPA defines "selling data" as: <blockquote>
The CCPA defines "selling data" as: <blockquote>
'' “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.''<ref name="ccpa"/>
'' “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.''<ref name="ccpa" />
</blockquote>  
</blockquote>  


Line 232: Line 232:
}}</ref>
}}</ref>


*'''Sponsored Suggestions in Search''': Mozilla processes search queries & shares de-identified interaction data with partners, including search engines and ad networks.<ref name="firefox-privacy"/>
*'''Sponsored Suggestions in Search''': Mozilla processes search queries & shares de-identified interaction data with partners, including search engines and ad networks.<ref name="firefox-privacy" />


Mozilla says all data shared with advertisers is anonymized, aggregated, or de-identified before being disclosed.
Mozilla says all data shared with advertisers is anonymized, aggregated, or de-identified before being disclosed.
Line 249: Line 249:
*'''Valuable Consideration Clause''': Mozilla earns money from clicks on Sponsored Shortcuts, which may be considered a sale under the CCPA if user data has "value."
*'''Valuable Consideration Clause''': Mozilla earns money from clicks on Sponsored Shortcuts, which may be considered a sale under the CCPA if user data has "value."


*'''Lack of a Clear "Do Not Sell" Option''': The CCPA requires an explicit "Do Not Sell My Data" button, but Mozilla bundles opt-out settings under "technical and interaction data." when Mozilla's privacy policy page states ''"You can opt out of having your data processed for personalization or advertising purposes by turning off “technical and interaction data” on Desktop and Mobile at any time"''<ref name="firefox-privacy"/> Firefox does have this option in the privacy and security section of the settings as of version 135 (4th Febuary 2025).<ref>https://support.mozilla.org/en-US/kb/how-do-i-turn-do-not-track-feature?as=u&utm_source=inproduct</ref>  
*'''Lack of a Clear "Do Not Sell" Option''': The CCPA requires an explicit "Do Not Sell My Data" button, but Mozilla bundles opt-out settings under "technical and interaction data." when Mozilla's privacy policy page states ''"You can opt out of having your data processed for personalization or advertising purposes by turning off “technical and interaction data” on Desktop and Mobile at any time"''<ref name="firefox-privacy" /> Firefox does have this option in the privacy and security section of the settings as of version 135 (4th Febuary 2025).<ref>https://support.mozilla.org/en-US/kb/how-do-i-turn-do-not-track-feature?as=u&utm_source=inproduct</ref>


*'''Potential Re-identification of Data''': CCPA states that anonymized data can still be personal information if it can be linked to a user.<ref name="ccpa" />
*'''Potential Re-identification of Data''': CCPA states that anonymized data can still be personal information if it can be linked to a user.<ref name="ccpa" />
Line 262: Line 262:
*'''Mozilla's Search Engine Deals Could Be Considered Data Sales''': As mentioned earlier, these partnerships could legally qualify as data sales under the CCPA definition, despite being an existing part of Mozilla's business model that consumers are already aware of.<ref name="tos-announce" />
*'''Mozilla's Search Engine Deals Could Be Considered Data Sales''': As mentioned earlier, these partnerships could legally qualify as data sales under the CCPA definition, despite being an existing part of Mozilla's business model that consumers are already aware of.<ref name="tos-announce" />


*'''Sponsored Content in Firefox's New Tab Page Involves Data Exchange''': Mozilla displays sponsored content and ads on the Firefox New Tab page, which may involve user interaction data being shared with advertisers.<ref name="tos-update"/> Even if the data is anonymized, the CCPA considers certain types of aggregated data as personal information if it can be linked back to users.<ref name="ccpa" />
*'''Sponsored Content in Firefox's New Tab Page Involves Data Exchange''': Mozilla displays sponsored content and ads on the Firefox New Tab page, which may involve user interaction data being shared with advertisers.<ref name="tos-update" /> Even if the data is anonymized, the CCPA considers certain types of aggregated data as personal information if it can be linked back to users.<ref name="ccpa" />


By removing explicit guarantees such as "we never sell your data" & rewriting the Terms of Use, Mozilla eliminated legal ambiguity while maintaining its existing business model.   
By removing explicit guarantees such as "we never sell your data" & rewriting the Terms of Use, Mozilla eliminated legal ambiguity while maintaining its existing business model.   
Line 279: Line 279:
|date=27 Feb 2025
|date=27 Feb 2025
|access-date=1 Mar 2025
|access-date=1 Mar 2025
}}</ref> This was later revised after backlash.<ref name="tos-update"/>
}}</ref> This was later revised after backlash.<ref name="tos-update" />


====Mozilla removed explicit language about not selling user data====
====Mozilla removed explicit language about not selling user data====
Line 291: Line 291:


====Users were not notified before the TOU changes took effect====
====Users were not notified before the TOU changes took effect====
Mozilla announced the new terms on February 26, 2025, but they had already taken effect by February 25, 2025.<ref name="tos-announce"/>
Mozilla announced the new terms on February 26, 2025, but they had already taken effect by February 25, 2025.<ref name="tos-announce" />


====Lack of clarity on why Mozilla needs a license to user input====
====Lack of clarity on why Mozilla needs a license to user input====
Line 312: Line 312:
|website= Mozilla
|website= Mozilla
|access-date=1 Mar 2025
|access-date=1 Mar 2025
}}</ref> Under the California Consumer Privacy Act (CCPA), a "sale" requires data to be transferred to a third party in exchange for monetary or other valuable consideration.<ref name="ccpa"/>
}}</ref> Under the California Consumer Privacy Act (CCPA), a "sale" requires data to be transferred to a third party in exchange for monetary or other valuable consideration.<ref name="ccpa" />
Since Mozilla does not explicitly transfer telemetry data to third parties, it is unlikely to be classified as a "sale" under the CCPA. Users can opt out of telemetry data collection, and Mozilla deletes previously collected data within 30 days of opting out.<ref name="telemetry" />
Since Mozilla does not explicitly transfer telemetry data to third parties, it is unlikely to be classified as a "sale" under the CCPA. Users can opt out of telemetry data collection, and Mozilla deletes previously collected data within 30 days of opting out.<ref name="telemetry" />