Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things to know about the GDPR, Mozilla and Firefox

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 103 posts

Re: Things to know about the GDPR, Mozilla and Firefox

#41

Post by athenot »

gcthomas wrote: post #24
dekrg wrote: post #14

That's interesting as what it's website privacy policy actually says looks the exact opposite of GDPR compliant. From https://www.mozilla.org/privacy/websites/ which is linked from as Privacy link from https://addons.mozilla.org . >We may use cookies, clear GIFs, third party web analytics, device information, and IP addresses for functionality and to better understand user interaction with our products, services, and…

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determime user preferences.

Re: Things to know about the GDPR, Mozilla and Firefox

#42

Post by JohnTHaller »

kuschku wrote: post #35
gcthomas wrote: post #24

Earlier quoted context omitted.

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

They’re using Google Analytics, by default, in the browser UI and on their Websites, without opt-in or visible opt-out (it’s hidden in the tracking prevention settings of the browser itself, and chained to the DNT setting). That’s about as violating as it gets.

Users are free to block third party cookies.

Re: Things to know about the GDPR, Mozilla and Firefox

#43

Post by paublyrne »

gregknicholson wrote: post #39
kuschku wrote: post #35

Earlier quoted context omitted.

They’re using Google Analytics, by default, in the browser UI and on their Websites, without opt-in or visible opt-out (it’s hidden in the tracking prevention settings of the browser itself, and chained to the DNT setting). That’s about as violating as it gets.

If Google is collecting the data, not Mozilla, who's violating?

After completing our mandatory and very boring GDPR training at work, I can tell you that it's Mozilla :)

Re: Things to know about the GDPR, Mozilla and Firefox

#44

Post by JohnTHaller »

billysielu wrote: post #19

OK great, can we have First Party Isolation enabled by default now? Y'know, for privacy. Browsers should be protecting users by default.

Just have the browser present the user with the choice on install.

( ) Enable third party cookies. This may allow third party websites to track you across the internet.

( ) Disable third party cookies. This may break some functionality on some websites.

It's no more confusing to end users than the endless sets of checkboxes websites have to use for GDRP or the pointless click OK to accept cookies notices.

Re: Things to know about the GDPR, Mozilla and Firefox

#45

Post by pjc50 »

throwaway2016a wrote: post #33
gcthomas wrote: post #24

Earlier quoted context omitted.

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

One of the most common interpretation I've heard is that IP address is PII according to GDPR. Even if not combined with other PII. So based on this description they are doing PII.

From the text of the directive:

"Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

An IP address is an "identifier". However, an IP address does not in and of itself identify a natural person; you know that, I know that, and even the GDPR knows that.

However, if you start building a map of IP addresses to user real names, or some other form of profile construction, then the IP addresses become personal information.

(comment hoisted from other thread)

Re: Things to know about the GDPR, Mozilla and Firefox

#46

Post by GlitchMr »

kuschku wrote: post #23

Great, so about:addons doesn’t use tracking Google Analytics cookies anymore? Or has a visible way to disable it (you need to enable DNT to get rid of this). And Firefox Nightly does not track personally identifiable telemetry anymore? No. Mozilla still tracks every step I take. What the fuck, Mozilla? EDIT: Example. Go to If you go to view-source: https://addons.mozilla.org/en-US/firefox/ — In the code you’ll find G…

> Great, so about:addons doesn’t use tracking Google Analytics cookies anymore? Or has a visible way to disable it (you need to enable DNT to get rid of this).

I can imagine this being legitimate interest, can be disabled with DNT flag, and it's not personal data. Mozilla signed a legal contract with Google which prevents Google from using this information.

> EDIT 3: See also https://www.mozilla.org/en-US/firefox/channel/desktop/ which explains that Nightly and Beta always send telemetry, which can not be turned off in any way, and your only way to avoid it is to stop using the product, which again violates the GDPR section on "free consent".

Options -> "Privacy & Security" > "Nightly Data Collection and Use"

Also, it uses word "automatically", not "always", and "Learn more" link on this page tells you how to disable that. Additionally, telemetry information is NOT personal data - it stores information like how many times you have opened web browsers, how many tabs do you use, but it doesn't send personal data.

Crash reports may contain personal data, but even on nightly, they aren't automatically submitted.

Re: Things to know about the GDPR, Mozilla and Firefox

#47

Post by icebraining »

kuschku wrote: post #35
gcthomas wrote: post #24

Earlier quoted context omitted.

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

They’re using Google Analytics, by default, in the browser UI and on their Websites, without opt-in or visible opt-out (it’s hidden in the tracking prevention settings of the browser itself, and chained to the DNT setting). That’s about as violating as it gets.

Are you accounting for the fact that Mozilla has a special contract with Google regarding the use of Analytics?

https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14

Re: Things to know about the GDPR, Mozilla and Firefox

#48

Post by kuschku »

GlitchMr wrote: post #46
kuschku wrote: post #23

Great, so about:addons doesn’t use tracking Google Analytics cookies anymore? Or has a visible way to disable it (you need to enable DNT to get rid of this). And Firefox Nightly does not track personally identifiable telemetry anymore? No. Mozilla still tracks every step I take. What the fuck, Mozilla? EDIT: Example. Go to If you go to view-source: https://addons.mozilla.org/en-US/firefox/ — In the code you’ll find G…

> Great, so about:addons doesn’t use tracking Google Analytics cookies anymore? Or has a visible way to disable it (you need to enable DNT to get rid of this). I can imagine this being legitimate interest, can be disabled with DNT flag, and it's not personal data. Mozilla signed a legal contract with Google which prevents Google from using this information. > EDIT 3: See also https://www.mozilla.org/en-US/firefox/cha…

> I can imagine this being legitimate interest, can be disabled with DNT flag, and it's not personal data. Mozilla signed a legal contract with Google which prevents Google from using this information.

Still it would require at least a cookie notice.

> Options -> "Privacy & Security" > "Nightly Data Collection and Use"

That does not disable all telemetry, there were a few discussions about this on the bugtracker, in Nightly, some kinds of telemetry can not even disabled through about:config as they are set to "locked: true".

Re: Things to know about the GDPR, Mozilla and Firefox

#49

Post by OldSchoolJohnny »

deaps wrote: post #31

I've gotten emails from sites I signed up for at least a decade ago. I find it troubling that that many sites I've signed up for had to actually change their privacy policies because of this. But I guess in the end, it's a good thing that they're all changing.

Pretty much every site you ever had to sign up for has had to change things, it's part and parcel of the process.

Re: Things to know about the GDPR, Mozilla and Firefox

#50

Post by inetknght »

athenot wrote: post #41
gcthomas wrote: post #24

Earlier quoted context omitted.

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

Once upon a day, twenty years ago, site feature selection were exactly what cookies were used for.
Post reply on HN