Privacy activist group noyb has filed a complaint against Mozilla over a "Privacy Preserving Attribution" feature that was quietly enabled in the Firefox browser following a July update.
"Contrary to its reassuring name, this technology allows Firefox to track user behavior on websites," noyb stated this morning. Worse: "Mozilla decided to turn it on by default once people installed a recent software update."
Firefox, which Statcounter places a solid fourth in browser market share, has a tagline that reads: "No shady privacy policies or back doors for advertisers. Just a lightning fast browser that doesn't sell you out."
According to Mozilla, the feature is designed to allow websites to understand how ads are performing without collecting personal data. With Privacy Preserving Attribution, the tracking is effectively done within Firefox itself and handed over anonymously to an aggregation service, which can give advertisers the information they need without compromising a user's privacy.
Noyb (none of your business) acknowledged that while the approach "may be less invasive than unlimited tracking," it still interfered with user rights under the EU's GDPR. To make matters worse, the feature is on by default.
Arguments over the feature have raged for a while, partly because it is opt out rather than opt in. A Mozilla engineer explained that "opt in is only meaningful if users can make an informed decision," but added: "In my opinion an easily discoverable opt out option + blog posts and such were the right decision."
Privacy campaigners would prefer such options to be opt in. Mozilla CTO Bobby Holley defended the feature on Reddit some months back and explained why it was an opt out feature: "It's on by default precisely because there is no spying. No one outside the device can reconstruct any information about an individual."
Mozilla also posted a lengthy blog explaining the technology at the end of August.
Felix Mikolasch, a data protection lawyer at noyb, wrote: "It's a shame that an organization like Mozilla believes that users are too dumb to say yes or no. Users should be able to make a choice and the feature should have been turned off by default.
- Meta back at it, harvesting Britons' public Facebook, Insta feeds for AI training
- Microsoft Bing Copilot accuses reporter of crimes he covered
- Microsoft ad subsidiary Xandr accused of violating GDPR
- Antitrust cops cry foul over Meta's pay-or-consent ultimatum to Europeans
"Mozilla has just bought into the narrative that the advertising industry has a right to track users by turning Firefox into an ad measurement tool. While Mozilla may have had good intentions, it is very unlikely that 'privacy preserving attribution' will replace cookies and other tracking tools. It is just a new, additional means of tracking users."
Noyb has asked the Austrian data protection authority to look into the issue. "Mozilla should properly inform the complainant and other users about its data processing activities – and effectively switch to an opt in system," the group wrote. "In addition, the company should delete all unlawfully processed data."
Christopher Hilton, Mozilla's Global Director of Corporate and Policy Communication, told The Register today via email that the feature could easily be disabled in Firefox's settings and was part of the corporation's "effort to improve invasive advertising practices by providing technical alternatives."
According to Hilton, the cryptography used makes it impossible for any party, including Mozilla, to identify an individual or their browsing activity.
"As we build out this technology beyond the prototype, which is limited to Mozilla websites, we welcome the opportunity to speak with stakeholders, our community, and regulators about how we are improving privacy in the advertising ecosystem." ®