Earlier quoted context omitted.
Can you please describe a theoretical attack on your privacy by Mozilla learning that your IP address launched a Firefox instance?
Burden of proof is not on the user. Burden is on Mozilla (and any browser vendor with telemetry ON by default) to prove that: 1) They are not misusing collected information in any way 2) They need it so badly that telemetry is ON by default, without the explicit consent of the user Both of these are simply addressed by having no telemetry by default and all browser telemetry being completely opt-in. Given that IP add…
Telemetry is a bit like DRM. Firefox strenuously avoided DRM for a long time, losing a lot of market share in the process, until it became clear that it could not stay relevant without being able to display DRM video. The pragmatic decision was either to (1) stay pure, forbid DRM, and disappear; or (2) give in and support DRM, accept that the battle was lost, and continue to survive in order to influence the battles that had not yet been lost.
The same could be said for telemetry, though it has less impact in either direction (it causes less harm, and not having it is less of an existential threat). And we (I work for Mozilla) did resist it for a long time, longer than was probably healthy for the market share, and eventually gave in. At least with telemetry it could be a somewhat principled capitulation—we are much more careful about avoiding tying together different measures that could be correlated to identify users, and we have a strict approval process when adding new telemetry (I've gone through it several times).
Telemetry is sadly necessary to stay competitive in today's landscape. For example, speed is the #1 reason that people report for switching browsers. Relying on either benchmarks or user reports for performance tuning simply isn't good enough. The signal is slow and massively lossy. We need to know what our actual users are experiencing, and whether a change had a positive impact on real-world usage or not. It's easy to come up with a change that improves benchmarks, at least a little. It's much harder to move the needle on what our users are experiencing. Without telemetry, we would make lots of changes that would overfit for benchmark behavior, adding complexity and producing very little benefit.
The other important piece: opt-in telemetry isn't telemetry. The sampling bias results in massive distortion. Being able to say "this change improves performance *for users who have opted in to telemetry*" is mostly useless. Users who opt in are going to have wildly different hardware, on average.
Opt out is much less problematic, even though it also introduces sampling bias, because in practice not that many people bother to opt out. It's definitely reasonable to argue that the opt out mechanisms should be simpler and more clear.
Though at the end of the day, it's much more important that we collect telemetry in a way that does not compromise the privacy of people who don't opt out, and (imho) we're doing pretty well there. https://www.mozilla.org/en-US/privacy/firefox/ gives a decent high-level overview. https://wiki.mozilla.org/Data_Collection gives more of the nitty gritty detail than you'd probably want.
