Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things to know about the GDPR, Mozilla and Firefox

blog.mozilla.org

Post reply on HN
Print view View original

51–60 of 103 posts

Re: Things to know about the GDPR, Mozilla and Firefox

#51

Post by tbranyen »

athenot wrote: post #41
gcthomas wrote: post #24

Earlier quoted context omitted.

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

This is a terrible use case for cookies. Any browser reset or change, new computer, your phone, etc, and you need to redo the whole experience every time. I'd rather login and customize once.

Cookies get sent with most requests as headers so you're unnecessarily bogging down requests with data unrelated to the session.

Re: Things to know about the GDPR, Mozilla and Firefox

#52

Post by gcp »

kuschku wrote: post #23

Great, so about:addons doesn’t use tracking Google Analytics cookies anymore? Or has a visible way to disable it (you need to enable DNT to get rid of this). And Firefox Nightly does not track personally identifiable telemetry anymore? No. Mozilla still tracks every step I take. What the fuck, Mozilla? EDIT: Example. Go to If you go to view-source: https://addons.mozilla.org/en-US/firefox/ — In the code you’ll find G…

https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14

"GA also doesn't track IPs or store PII within the tool."

Re: Things to know about the GDPR, Mozilla and Firefox

#53

Post by lmkg »

throwaway2016a wrote: post #33
gcthomas wrote: post #24

Earlier quoted context omitted.

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

One of the most common interpretation I've heard is that IP address is PII according to GDPR. Even if not combined with other PII. So based on this description they are doing PII.

GDPR introduces a new concept called "Personal Data" which includes things like IP addresses and opaque database keys. Something is personal data if it is tied to an individual, regardless of whether sufficient information to identify that individual is contained in the data itself. An IP Address (or, according to some interpretations, an IP Address + timestamp but not an IP Address on its own) is Personal Data but not PII.

The GDPR does not address PII at all. To a first approximation, PII is now an American legal concept and Europe has a completely different (and strictly broader) definition of privacy-relevant data.

Re: Things to know about the GDPR, Mozilla and Firefox

#54

Post by icebraining »

kuschku wrote: post #23

Great, so about:addons doesn’t use tracking Google Analytics cookies anymore? Or has a visible way to disable it (you need to enable DNT to get rid of this). And Firefox Nightly does not track personally identifiable telemetry anymore? No. Mozilla still tracks every step I take. What the fuck, Mozilla? EDIT: Example. Go to If you go to view-source: https://addons.mozilla.org/en-US/firefox/ — In the code you’ll find G…

The GDPR only regulates use of personal data, not all telemetry, though.

Re: Things to know about the GDPR, Mozilla and Firefox

#57

Post by ryanwaggoner »

krageon wrote: post #12
jhall1468 wrote: post #5

Earlier quoted context omitted.

And a ton of non-EU companies don't, but are doing so for future purposes. Despite territorial scope, a company without any form of business in the EU, they can't entorce this against non-EU businesses.

You are wrong. This is a misconception that has thankfully died down a bit over the past week or so, but apparently it is still a bit alive. There are accords in place between (for example) the US and the EU, which allows the EU to hand out fines overseas. The reverse is also true (the US can and does litigate in the EU).

Bullshit. Please tell me how the EU has any possible way to enforce this law in the courts against some small business in the US that has no EU presence but many EU customers. There is zero chance that US courts are going to let this small business be fined by the EU for violating an EU only law.

Their absolute best option would be to attack global platforms that small businesses rely on to get the platforms to enforce compliance or blacklist those small companies. This is especially potent for Visa and MasterCard. I doubt that will ultimately work though.

Re: Things to know about the GDPR, Mozilla and Firefox

#58

Post by diego_moita »

kadenshep wrote: post #38

GDPR is the best thing to have happened to the internet in a long while.

I downvoted because your comment doesn't add anything to the discussion and, in the context of this post, looks a bit like trolling.

There are people that like and do not like the GDPR. Telling that you belong to one group is not even information.

Re: Things to know about the GDPR, Mozilla and Firefox

#59

Post by billysielu »

JohnTHaller wrote: post #44
billysielu wrote: post #19

OK great, can we have First Party Isolation enabled by default now? Y'know, for privacy. Browsers should be protecting users by default.

Just have the browser present the user with the choice on install. ( ) Enable third party cookies. This may allow third party websites to track you across the internet. ( ) Disable third party cookies. This may break some functionality on some websites. It's no more confusing to end users than the endless sets of checkboxes websites have to use for GDRP or the pointless click OK to accept cookies notices.

Yeah I'd be happy with that approach, should include upgrades as well as new installs though. Just to have every user aware that their browsers contain a single setting that can prevent vast amounts of tracking would be a huge improvement over today.

Re: Things to know about the GDPR, Mozilla and Firefox

#60

Post by ReidZB »

athenot wrote: post #41
gcthomas wrote: post #24

Earlier quoted context omitted.

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

"User-interface customization" cookies are actually explicitly exempt from EU consent requirements: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

I believe they should not be affected by GDPR either, since they're not actually identifying a person.

Post reply on HN