Today, noyb filed a complaint against Mozilla for quietly enabling a supposed “privacy feature” (called Privacy Preserving Attribution) in its Firefox browser. Contrary to its reassuring name, this technology allows Firefox to track user behaviour on websites. In essence, the browser is now controlling the tracking, rather than individual websites. While this might be an improvement compared to even more invasive cookie tracking, the company never asked its users if they wanted to enable it. Instead, Mozilla decided to turn it on by default once people installed a recent software update. This is particularly worrying because Mozilla generally has a reputation for being a privacy-friendly alternative when most other browsers are based on Google’s Chromium.
Firefox follows Google? With a recent Firefox update, Mozilla seems to have taken a leaf out of Google’s playbook: without directly telling its users, the company has secretly enabled a so-called “Privacy Preserving Attribution” (PPA) feature. Similar to Google’s (failed) Privacy Sandbox, this turned the browser into a tracking tool for websites. The idea: instead of placing traditional tracking cookies, websites have to ask Firefox to store information about people’s ad interactions in order to receive the bundled data of multiple users.
Less invasive is still invasive. In this sense, Mozilla claims that the development of “privacy preserving attribution” improves user privacy by allowing ad performance to be measured without individual websites collecting personal data. In reality, part of the tracking is now done directly in Firefox. While this may be less invasive than unlimited tracking, which is still the norm in the US, it still interferes with user rights under the EU’s GDPR. In reality, this tracking option doesn’t replace cookies either, but is simply an alternative - additional - way for websites to target advertising.
Felix Mikolasch, data protection lawyer at noyb: “Mozilla has just bought into the narrative that the advertising industry has a right to track users by turning Firefox into an ad measurement tool. While Mozilla may have had good intentions, it is very unlikely that 'privacy preserving attribution' will replace cookies and other tracking tools. It is just a new, additional means of tracking users.”
Tracking by default, no information. To make matters worse, Mozilla has turned on its “privacy preserving attribution” by default. Users have not been informed about this move, nor have they been asked for their consent to be tracked by Firefox. The feature isn’t even mentioned in Mozilla’s data protection policies. The only way for users to turn it off is to find the opt-out function in a sub-menu of the browser’s settings. Irritatingly, a Mozilla developer justifies the move by claiming that users can’t make an informed decision.
Felix Mikolasch, data protection lawyer at noyb: “It’s a shame that an organisation like Mozilla believes that users are too dumb to say yes or no. Users should be able to make a choice and the feature should have been turned off by default.”
Millions of European users are affected. noyb asks the Austrian data protection authority (DSB) to investigate Mozilla’s behaviour. Mozilla should properly inform the complainant and other users about its data processing activities – and effectively switch to an opt-in system. In addition, the company should delete all unlawfully processed data.
