3d ago

Firefox deletes promise to never sell personal data, asks users not to panic

arstechnica.com Firefox deletes promise to never sell personal data, asks users not to panic

Mozilla says it deleted promise because “sale of data” is defined broadly.

Firefox maker Mozilla deleted a promise to never sell its users' personal data and is trying to assure worried users that its approach to privacy hasn't fundamentally changed. Until recently, a Firefox FAQ promised that the browser maker never has and never will sell its users' personal data. An archived version from January 30 says:
Does Firefox sell your personal data?
Nope. Never have, never will. And we protect you from many of the advertisers who do. Firefox products are designed to protect your privacy. That's a promise.
That promise is removed from the current version. There's also a notable change in a data privacy FAQ that used to say, "Mozilla doesn't sell data about you, and we don't buy data about you."
The data privacy FAQ now explains that Mozilla is no longer making blanket promises about not selling data because some legal jurisdictions define "sale" in a very broad way:
Mozilla doesn't sell data about you (in the way that most people think about "selling data"), and we don't buy data about you. Since we strive for transparency, and the LEGAL definition of "sale of data" is extremely broad in some places, we've had to step back from making the definitive statements you know and love. We still put a lot of work into making sure that the data that we share with our partners (which we need to do to make Firefox commercially viable) is stripped of any identifying information, or shared only in the aggregate, or is put through our privacy preserving technologies (like OHTTP).
Mozilla didn't say which legal jurisdictions have these broad definitions.

Technology @lemmy.world

ForgottenFlux @lemmy.world

3d ago

Firefox deletes promise to never sell personal data, asks users not to panic | Mozilla says it deleted promise because "sale of data" is defined broadly

arstechnica.com /tech-policy/2025/02/firefox-deletes-promise-to-never-sell-personal-data-asks-users-not-to-panic/

1279 312

Privacy Guides @lemmy.one

ForgottenFlux @lemmy.world

3d ago

Firefox deletes promise to never sell personal data, asks users not to panic | Mozilla says it deleted promise because "sale of data" is defined broadly

arstechnica.com /tech-policy/2025/02/firefox-deletes-promise-to-never-sell-personal-data-asks-users-not-to-panic/

226 29

PC Master Race - PCMR: A place where all enthusiasts of PC, PC gaming and PC technology are welcome! @lemmit.online

Lemmit.Online bot @lemmit.online

BOT

3d ago

Firefox deletes promise to never sell personal data, asks users not to panic

arstechnica.com /tech-policy/2025/02/firefox-deletes-promise-to-never-sell-personal-data-asks-users-not-to-panic/

1 0

93 comments

“Never” - You keep using that word. I’m not sure it means what you think it does.

You cant go back on never have never will without breaking the law. We need to get these ai tech bros out of these companies if we want them to remain good.

also
Update at 10:20 pm ET: Mozilla has since announced a change to the license language to address user complaints. It now says, "You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content."
Mozilla may also receive location-related keywords from your search (such as when you search for "Boston") and share this with our partners to provide recommended and sponsored content. Where this occurs, Mozilla cannot associate the keyword search with an individual user once the search suggestion has been served and partners are never able to associate search suggestions with an individual user. You can remove this functionality at any time by turning off Sponsored Suggestions—more information on how to do this is available in the relevant Firefox Support page.
So, turn off Sponsored Suggestions and you're (probably) good to go.
- Good they rolled it back. Feels a bit like go for what you want and see how folks react, then have a plan for rolling it back.

Made the switch to Fennec and IceRaven on Android, and Zen on my Linux desktop, which also has Windows and Mac versions. Sure, they're forks of Firefox, but they are not subject to the same TOS. I used to use LibreWolf on my desktop but ended up having too many issues with it. Lots of crashing and instablility that regular Firefox just didn't have.
Another great tool for unGoogled Android users is FFUpdater. It will handle updating of many open source (not just Firefox-based) browsers. You could also use something like Obtanium for something less browser-specific.

Never have, never will.
So, here's the funny thing about "never will". It's not a promise you can go back on. "Never will" means "forever won't".
Changing that language is a breech of trust. Getting all "nuanced" and weasel-wordy about it doesn't change that.
Folks should start looking into whether the previous promise is legally binding in any way, and start preparing for a class action suit if it is. Because Mozilla's better dead than it is as zombie smoke screen for this horse shit.
- The equally hilarious thing is that currently they have the "never will" promise in the same codebase as the "definitely will" gated by a "TOU" flag, showing intent to violate the promise.
- You realise if Mozilla disappears there is only chromium
  
  That doesn't detract from OP's point. I want Mozilla to be a good, privacy respecting organization, but they aren't anymore, and chromium has nothing to do with that.
  
  If Firefox disappears. Mozilla isn't Firefox, it's the organization staffed with ad-tech and McKinsey ghouls and paid by Google to kill Firefox.
  
  They've been hiding behind that excuse for a decade now. How far do they get to take it? How far do they get to go before we're "allowed" to tell them to eat shit?
- It seems like the issue here is, users want to be spoken to in colloquial language they understand, but any document a legal entity produces MUST be in unambiguous "legal" language.
  So unless there's a way to write a separate "unofficial FAQ" with what they want to say, they are limited to what they legally have to say.
  And maybe that's a good thing. Maybe now they need to create a formal document specifying in the best legalese exactly what they mean when they say they "will never sell your data", because if there's any ambiguity around it, then customers deserve for them to disambiguate. Unfortunately, it's probably not going read as quick and catchy as an ambiguous statement.
  
  the issue here is
  The issue is Mozilla's McKinsey CEO has decided to break the promise not to sell personal data.

The ToU is in Mozilla's Bedrock repo, but I don't quite know what that repo does. I'm curious if Firefox forks would still be subject to it.

Some obvious jurisdictions that come to mind, are US vs. EU:
US: protects "Personally Identifiable Information" (PII)
EU: protects "Personal Information" (PI)
The color of your hair... is PI in the EU, it isn't PII in the US since it's not enough to pinpoint you as a single person.
Under US law, a data broker can gather a bunch of "not-PII, just PI", and refine it into profiles that can end up pinpointing single individuals.
Under EU law, that's illegal; no selling PI, period.
- This is completely accurate, and people don't know how non anonymous it is.
  Your hair one for example. Who cares, say you even have brunette hair, something generic. Okay, then let's add on that you're using an iPhone. How narrow is the search now? What state you're in? Who owns a specific model of TV?
  I would argue that with only just a few data points you could be identified.
  And now they are taking everything you put into your browser and everything you take out. Add some AI pizazz and they'll be able to build a pretty accurate profile about you.

We will collect data about you and sell it, but only after we've run it through a privacy preserving machine that turns it into privacy jam so you can't tell how much of yours is in the jar.
- Mmm... privacy jam.
- While not ideal, privacy jam is better than the status quo of precise fingerprinting.
  
  Indeed, fingerprinting. Preventing it is one thing Mozilla could be working on. Going all-out on it really, devoting significant engineering resources to making their browser fingerprinting resistance bulletproof. Reworking every js api with defence against adversarial use of it in mind. If they're really that desperate for cash they could sell it as a premium feature for a modest subscription fee, although obviously it'd be available free of charge for those willing to get their Firefox builds from someone other than Mozilla.
- Don't panic, though! Much like the competition does, while we sell your data we'll tell you all about how we respect your privacy so much more than the competition does. It's for the best. Driving away all its users is the only way to make Firefox commercially viable. That's just how capitalism works.

Fuck's sake, might as well be a warrant canary.
And they're peddling the myth of anonymous data. Great.
Are any of those independent browser projects functional yet?
Konqueror, which is Webkit, is still actively developed, though less feature-rich than more popular browsers.
- I am looking into zen and librewolf, both are forks of Firefox tho.
  
  Forks of Firefox is fine. Only their binary is subject to the TOS. The source code remains under MPL2
  
  Been using Zen for a while, it's very good
- Ladybird and Servo are both in Alpha, but worth keeping an eye on.

So .... what is the leading alternative browser then?
One of the reasons Firefox became so popular was that it was an alternative.
Now that they're drifting towards something we don't like ... what is the new alternative?
- https://librewolf.net/
  
  Librewolf has some trouble with some websites. For example, it won't load one of my own that makes a GRPC request over TLS, stating that the certificate issuer is unknown despite it being the same certificate used on the accepted-as-secure page the request is made from.
  
  ...which is Gecko, which is Mozilla.
- Welp, back to NCSA Mosaic I guess. We never needed CSS and JS anyway, those were a huge mistake.
  
  Heck, we should go back all the way to lynx!
- I’m trying https://zen-browser.app/ now. It’s an open source fork of Firefox. The UI is much changed: vertical tabs and workspaces. It was a bit of a shock, but it’s growing on me.
  
  ...which is Gecko, which is Mozilla.
  
  How is it with blocking ads?

What do you think of duckduckgo's browser? It's about page seems to be on par.

So since their actions can be considered "sale of data", they are breaking their promise which stated that they will never do that. Got it!

You know, at least it's not Brave, throwing in cryptomining bs, getting caught selling data without telling anyone, or using the profits to push COVID conspiracy theories and anti-LGBT activism, or getting their funding directly from Founders Fund (Peter Thiel).

What's the best alternative in* apt now?
- What do you mean? Firefox alternatives in Debian/Debian-based repos? Or just an alternative for apt in general (in which case, I think you've replied to the wrong post)?
  
  Yes, I'm asking for the best Firefox alternative thats available on Debian or debian-based distos. Only considering packages in the official Debian apt repos

From the Mozilla forums.
I'm curious what "Without it, we couldn’t use information typed into Firefox to perform your searches, for example" means. Like, is that literally just the search I type into the browser bar, or are they talking about scraping data from my browser to improve my searches the way a lot of phone apps do?
I could see some government somewhere passing a data security bill of some kind that makes rules around collecting and using data that redefines what that means in a way that includes something Firefox is already doing. I could also see them using this as a sneaky foot in the door as they plan to ramp up data profiteering like so many companies already have.
It would be nice if they'd clarify their reasoning for doing this a bit more specifically.
- They want to intercept your searches and url entries to run them through the privacy preserving data extracting machine in order to collect data that will be sold to advertisers and used to pollute your search results and url suggestions with paid-for links. They were trying to be vague about it so that people would not understand this, and instead all they accomplished was to make people think they want to record everything you type into every web form. That's my guess, anyway. Maybe they really do want everything.
  
  I mean, yeah. That's the less than optimistic guess to make. But it's a guess, it isn't definitive. It'd be nice to know if that's what they're actually doing or whether it's just a change in language to cover their own ass. Because both are pretty common.
- Think about it. Anything you type into a browser is your intellectual property, you own the copyright to it, unless you're copying someone else's text. In order for Mozilla to pass what you type on to any website you're visiting, they need to "copy" that text (i.e., from the keyboard to the network).
  I think this is what they're trying to address with their legalese. It's a pity that it has to come to this, but that's how the legal environment is these days. They can't afford to make expensive mistakes. Perhaps they can keep improving and clarifying the language though.
  
  Firefox is not a legal entity needing a license. Mozilla is.
  Firefox is a product, not a service.
  When I write notes in a book, I do not need to give the manufacturer of that book a license for my notes. If I mail that book to a friend, I do not need to give a license for that book to the post office.
  The only other software that I can think of that has taken a similar stance on TOS vs an open license is Microsoft and their VS Code product. Precompiled executables are license under a non-free (libre) license while the source code of VS Code remains under the MIT license.
  The original license of Firefox MPL2 allow end users to freely use the browser, with no license needed to give to Mozilla. Thousands of open source software who all use GPL, MPL, MIT, et al. allow users to use their software however they want. The proposed TOS does not and you must abide by their Acceptable Use Policies.
  Even if they require a license due to some legal reason, there is simply no reason why the license has to be a non-exclusive, perpetual license. If it really as they claim "to help you navigate the internet", then the terms should explicitly say that, and not make it implicit.
  The fact is Mozilla doesn't need a license for me to operate Firefox locally. Any copyright claim they are making is in bad faith because anything you type into the browser would be covered under fair use. They have yet to convince me why they need a license for me to operate a browser fully locally.
  The most likely reason why they are changing the license is because they want to start training AI data based on your browser habits. They may not be doing it now and they may say they have no plans to do it in the future. But the TOS, as currently written, gives them permission to do just that.
  
  Yeah. That's certainly a possibility. Thinking about it won't give me the answer, though. It could be that, it could also be something else. We don't learn the truth of what's going on in the world by just making up a good-sounding explanation and assuming we must be right, even if that's how people discussing things on forums largely operates.

/checks for dolphins flying out of the oceans
- So long, and thanks for all the add-ons.
  In seriousness, though, this doesn't in any material way make Firefox a worse option than the other browsers with active dev teams. Avoiding Manifest V3 is alone worth the price of admission.

I tend to trust Mozilla (more than other browser-owning companies), but they really should just clarify exactly what they do that would be considered as sale of data in any jurisdictions.
They seem to be implying that the data is just metadata that has been abstracted for (presumably ad-targeting) commercial purposes, and there are jurisdictions that consider derived metadata as still being "user data", but in that case just make a blog post laying out what and where you are sharing. If your "partners" are opposed to people knowing about them, or you are scared that people would not like who you're in bed with, that is a problem.

Maybe they should replace it with Google's former pledge "Don't be evil": it's free for the taking, nobody's using it at the moment.

Please panic. There's Librewolf. A deshittified Firefox fork. Would be great to support that project.

I hope they explain further. Honestly I don’t think the “oh crap I need to know if it’s good or bad right now!” camp is really going to care, but it still feels a little uncomfortable. (As opposed to the “this could be either way, I don’t have enough evidence to decide right now, and I’m ok with holding that uncertainty in my brain until new evidence moves my needle” camp)
Are forked builds possible with third party service references neutered?

Look up browser called Ladybug. It is not based on either WebKit or Chromium.
It's not ready yet but it's coming.
https://discord.gg/ruhpveCz
- Is it open source, or is it owned by a private company? Looks exactly like the kind of thing that'll be great for a few years and then become enshittified, like all for-profit software inevitably seems to.
  
  Ladybird is a non profit developed by volunteers, no company.
  Project lead is Andreas Kling (you should definitely watch his development videos and streams), great guy who developed SerenityOS aswell, an operating system from scratch. For that he developed LibWeb which he then used to create Ladybird. They only recently founded a non-profit, which is probably needed as the project size grew.
- Ladybug seems to have garnered quite the attention and funding. It will probably be a great alternative for anyone looking for one. But I personally would not use it, the dev's behaviour has made me keep my distance from the project.

Mozilla's fans ready to take the pitchforks whenever other Corps. have miniscule missteps are strangely silent today.
- Firefox Reddit sub is pretty full of outrage posts. Rightfully so.
  I've been a long time supporter of Firefox because fuck Google and their Chromium spawns feeding their dominance, but what Mozilla is doing now, I'm planning on moving to Waterfox from the looks of it. Present on all platforms, Android, Windows and Linux, supports sync and has all the tracking and telemetry bullshit stripped out. I just wish they'd get versions up to date a bit faster, but oh well, it's probably a small team of people doing it in their free time so I can't complain too much.
  
  I like Waterfox. I started using it for the JXL support. But it's significantly more memory-leaky than the current version of Firefox, and small FOSS teams seem to think the standard amount of RAM sold in laptops today is comically low and believe we're all hauling 64+ GB or something.
- You just woke up, right? It's been discussed everywhere today.
  
  I fail to see the outrage.
- This post is less than half an hour old, can you let people see it first before complaining of silence?
- What, there has been a huge reaction to this!

Have any of you FUD shoveling geniuses considered that this is because Firefox uses encrypted DNS by default?

That condition is a despotic red-flag deal-breaker that should be countered with epic abandonment. Let them know this is not OK. If I hadn't uninstalled it years ago, I would have already. Lots of better browsers out there.

Maybe the should replace their CEO wit AI:
https://www.perplexity.ai/search/consider-the-following-you-are-SHB99o4pQHCsG_BgZrbTLw#0

93 comments