An Update on our Terms of Use

[AshleyT]

On Wednesday we shared that we’re introducing a new Terms of Use (TOU) and Privacy Notice for Firefox. Since then, we’ve been listening to some of our community’s concerns with parts of the TOU, specifically about licensing. Our intent was just to be as clear as possible about how we make Firefox work, but in doing so we also created some confusion and concern. With that in mind, we’re updating the language to more clearly reflect the limited scope of how Mozilla interacts with user data.

Here’s what the new language will say:

You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content. 

In addition, we’ve removed the reference to the Acceptable Use Policy because it seems to be causing more confusion than clarity.

Privacy FAQ

We also updated our Privacy FAQ to better address legal minutia around terms like “sells.” While we’re not reverting the FAQ, we want to provide more detail about why we made the change in the first place. Check out the full blog post to read more.

[seva]

"It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content. "  
Sorry, but this wording means that you will get the right to sell t-shirts with my artwork if I send artwork using Firefox. You will not get ownership of my drawing, but you will get a license to use it in any way, i.e. you can print it on mugs, t-shirts, make posters, etc.

[LSD123]

Thought you didn't sell our data and NEVER will? Been using Firefox for 15+ years. Never using it again.

[firebird]

Overall the language is much better. For the purpose of doing as you request is much clearer and more reassuring language.

It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox.

Is this limited to a few key areas like Search Suggestions and New Tab? It would be good to enumerate every use of our information instead of providing a blanket license to use any of it. The new version mostly seems to say this, but it would be good for it to use the word "only".

A short bullet-point summary of all the data usage Mozilla gives itself rights to conduct from the privacy policy would also be great, as the privacy policy is a lot to read.

I guess this section would actually be pretty similar to that bullet point list? https://www.mozilla.org/en-US/privacy/firefox/#lawful-bases

(To other commenters, please avoid personally attacking employees at Mozilla.)

[seva]

I think if you had trusted the community and honestly said that you were faced with the choice between going bankrupt and launching your own ad service, the community might have supported you.

Instead of forcing the community, you could have given the community a choice, like you give the community a choice with statistics collection. When update, there will be a window with a choice of two options:
1. I want to support Mozilla, so please enable Mozilla's ad service.
2. Do not enable Mozilla's ad service. I am not going to support Mozilla in this way.

[Deadoon]

As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”  

---

That doesn't seem all that different from a layman's comprehension of selling data to me.

[yolo1]

You clearly hide something about the new IA features.
Please put this in a plugin first before deploying these features. If your plugin becomes popular, integrate it into your core software. Stop using your core userbase to capitalize on it.

[Xerxes01]

Are Mozilla's leaders possibly alienating their long-standing, privacy-conscious users with these questionable decisions?

I'm telling you if Firefox doesn't revert to its old, user-respecting TOS, they're practically begging for its downfall!

[joeyh]

Will Mozilla be firing the incompetent managers and lawyers who drafted the overly broad and badly written original version?

Or was this a precalculated maneuver, leading with the overly broad land grab and backpedaling right to where you wanted to be all along?

[tpdi]

In every communication about this, you've been careful to include the parenthetical qualification '(in the way that most people think about “selling data”)'

> TL;DR Mozilla doesn’t sell data about you (in the way that most people think about “selling data”), and we don’t buy data about you.

When I see something repeated verbatim in *every* communication, I assume that's because a lawyer has said "it's essential that you always include this."

And it's weaselly. "In the way that most people think" is subjective and doesn't actually specify what that thinking is.

It also implies that even if "most people" don't consider it selling data, *some people* do consider it selling data. 

So, in other words, 'Mozilla doesn’t sell data about you (in the way that most people think about “selling data”)' can be and probably should be interpreted as a cleverly obscurantist way to say "Mozilla does sell data about you (just not in the way that most people think about 'selling data')."

My guess is a lawyer has told you to always make sure you phrase it in this way, in order to publicly appear to say "we don't sell users' data" while in fact *not*, technically, claiming that you don't sell user data.

So who came up with the qualification "(in the way that most people think about 'selling data')"?

And were you, Ashley, instructed to always include that qualification?

What's *not* included in "the way most people think about 'selling data'"?

And of those not included ways, which ways are Mozilla reserving the right to sell our data?

[user9164967254]

This response is wholly inadequate.  Although some of the points of https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privac... have been addressed, many have not.  Also, there are now even more issues with the new post:

---

The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”

---

That is just about exactly how I would define "sharing data".

---

In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners, including our optional ads on New Tab and providing sponsored suggestions in the search bar.

---

So you are saying you have been violating your promise for a long time now.  Uhhhh, thanks for bringing it to my attention?

---

Whenever we share data with our partners, we put a lot of work into making sure that the data that we share is stripped of potentially identifying information, or shared only in the aggregate, or is put through our privacy preserving technologies (like OHTTP).

---

Cool.  Still violates your previous promise.  Being less evil than Google does not absolve Mozilla of all wrongdoing.

I've been daily driving Firefox since I was a young child, but it's time for me to hop out of the pot.

---

---

[tpdi]

From <s>Dan Brown's</s> Ajit Varmas's blog post:

> The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.” 

So, the Mozilla Foundation, founded in California, and the Mozilla Corporation, headquartered in California, intend to do things that under California law are considered to be the sale of data, as passed by a majority of the California Assembly and signed by the California governor into law, but Mozilla wants to pretend those things are not a sale of data?

As Abe Lincoln asked, how many legs does a dog have, if I call its tail a leg?

Mozilla, a California corporation, doesn't get to redefine California law to hide inconvenient truths.

Just admit it: "we intend to do things that under California law constitute the sale of users' data. But under the laws of Belarus, Kazakhstan, and the Democratic Republic of the Congo, those things are totally not the sale of user data, so we're completely in the clear, trust us!"

Some super-clever Wharton School MBA came up with this, right?

[i430VX]

I am happy to see some things resolved in this clarification. However, I am in agreement with Firebird above (and presumably others) that it would be nice to see a more solid, exhaustive list (to the extent possible) of what is meant by the license part. The wording "as you request" is still, in my layperson's eyes, still somewhat too much open to interpretation to make me feel comfortable about it.

[EmmanuelMess]

From the blog entry:

> Firefox also shows its own search suggestions based on information stored on your local device (including recent search terms, open tabs, and previously visited URLs). These suggestions may include sponsored suggestions from Mozilla’s partners, relevant content from common internet resources (such as Wikipedia), or relevant URLs that are popular in your country. Mozilla processes certain technical and interaction data, such as how many searches you perform, how many sponsored suggestions you see and whether you interact with them. Mozilla's partners receive de-identified information about interactions with the suggestions they've served. You can enable or disable Search suggestions at any time.

There is a problem with this wording, it implies that even when the seach suggestions are disabled, the data can be shared with Mozilla or 3rd parties. I don't think this would be acceptable. I would recommend a blanket "all data sharing with 3rd parties can be disabled".

Also here:

> Learn more about how we categorize searches, including how to opt out.

I don't want to opt out of the feature per-se, I would want to opt out of the *data sharing* and *large scale mining*.

[wwahammy]

I'll copy in what I sent to the Mozilla Foundation folks when they asked me for a donation:

Please pass this along to your board members and your executive director. Seriously. Please.

I've been a Mozilla user and Firefox advocate for a decade plus. I've donated to the Foundation. I've advocated for Common Voice and encouraged people to contribute to it. I stuck with and supported you all no matter what.

After your fully owned subsidiary's Terms of Use fiasco this week, it's insulting to ask me to donate. The lack of any sort of consideration of your customers and users and donors is just astounding. After all of this, I'm done with Mozilla Corporation, Foundation, etc, etc. I'm leaving Firefox, I'm writing off the foundation and want nothing to do with with you. I can't figure out why every member of your organization continually despises your constitutents but I'll help you out, I won't be a user, I won't be donor and I will ignore Mozilla's very existence.

[welyr]

The definition of "selling data" under the "CCPA" which is referenced absolutely is what I would consider selling data.  

They may tweek this or that in these terms, that privacy policy could belong to any for profit company that harvests people's data for money.  It clearly states they are using our data to serve up targeted ads.  These are basically Mozilla's documents of surrender to surveillance capitalism.

Also all my previous comments that they would still need to turn over any data they collect in response to "Lawful Requests" still stands (and that doesn't meant the ones making such requests would necessarily be "the good guys" from our point of view).  My concerns about how this makes Firefox unsuitable for individuals who are serious about privacy still stand.

[Chris-Winters]

@AshleyT 

I just want to point out your original post got 6 "Kudos" and 244 replies... if you weren't aware this is called "getting ratioed". It means the content of the post was quite unpopular and whoever instructed you to say this should rethink their strategy here, and then begin training their replacement because this is a colossal failure. But I'm certain Mozilla will just call us all bigots, spend another $10 Million on another conference for 7 blue haired they/thems and a disabled xe/xir with a buzzword salad for a name and keep chugging along ignoring the massive fire burning the whole building down around them.

You're not dealing with gullible and impressionable first graders. A lot of us were building the foundations of the internet before you were even born. If you think this move will lead to success for Mozilla you've all become delusional. Snap out of it. 3% browser market share and falling. If that were a stock price the shareholders would be jumping ship before you inevitably filed Chapter 11 and declared bankruptcy, and then they'd be discussing options for lawsuits with their attorneys.

Let me rephrase that in case my meaning isn't completely understood;

MOZILLA. IS. NO. LONGER. POPULAR. ENOUGH. TO. GET. AWAY. WITH. THIS! Mozilla simply doesn't have enough good will left over to recover from this.

As a reminder. Firefox is completely open source, which means a hard fork is just a few clicks away. We don't need Mozilla for Firefox to continue... but Mozilla certainly needs Firefox.

But let me try to be somewhat helpful here, because contrary to what you might think based on this and other comments I've made I don't actually want to see Mozilla disappear.

Let's begin with the fact that all of this broad legalese is spread across 3 or 4 separate legal documents, that all reference each other multiple times so the user is expected to consecutively read and agree to at least 3 legal agreements that all contain overly broad and intentionally confusing legal speak... and somehow come out with a precise understanding of what we are permitting Mozilla to do with precisely what data and exactly when and for how long?

"This includes processing your data as we describe in the Firefox Privacy Notice."

Why can't this section include the relevant part of the "Privacy Notice"?

Next, let's tackle the next part.

"It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox."

Explain, precisly, why Mozilla needs a "nonexclusive, royalty-free, worldwide license" to any "content" users input into Firefox. The example you gave in your first attempt to "clarify" this mentioned searching. Well, as pointed out by myself and others, Firefox currently redirects search terms to the users selected default search engine and you currently DO NOT need any "nonexclusive, royalty-free, worldwide license" for this functionality to work.

Allow me to use an analogy to precisely spell out how I interpret this part of this sections.

I'm going to need you to hand me a key to your house, and grant me "nonexclusive, royalty-free, worldwide license" to enter your house "for the purpose of doing as you request" but don't worry, I totally won't ever go into your house without your knowledge or permission...

See the problem here? If you want me to go into your home to do anything, you can totally do that already without having to give me the key and trusting that I won't simply walk in whenever I want. You can open your own door and invite me in, you can be present while I do what you asked of me, and you can watch me leave afterwards and lock the door behind me when I do. I don't actually need a key to your home. But you're asking us for the keys to our data? And so far the justification for it has been "Just trust me bro"?

Do you get it yet? You have to understand this. There is no possible way you don't know what you're doing at this point. I'm all out of benefit of the doubt for you.

[SirWolf]

You want to train our data for AI, that's what you're doing. No matter how you formulate it, the overall message is the same. No matter why you're "stealing" our data, it's disgusting. A browser is our entry point to accessing the Internet, not your entry point to legalized spyware. The Firefox days are over. Stop deceiving us, it's not gonna work.

[Serg1]

I am not convinced, at all - it still sounds vague, unintuitive and unnecessary. I chose FF exactly because of "Nope, never, under no circumstances for no intents or purposes we do not collect, store, process on the fly, pass or use your data, other than to serve your explicit request, for example show you the web page you accessed or autofill the email address you asked us to save. Period."

This is what I want to see, so there would be no place for any shenanigans like 'partners', 'analytics', 'recommendations', 'ai training' and other BS.
Please make it right, and make it right right now, otherwise I personally will be looking for another browser, even though I hate the idea, but what choice do you leave me...

[IloveFirefox]

Mozilla did not need my data before. Mozilla doesn't need it now. Nor will it ever.
My data is between ME and the WEBSITE I CHOOSE TO VISIT. Not the browser.
Privacy Preserving Advertising is a delusional solution at best.

Mozilla better correct course immediately. Otherwise enjoy your downfall. You certainly earned it.

[soleniae]

this is heinous.

i've been an avid proponent for the mozilla ecosystem - not agreeing with all actions and positions but broadly firmly in support of the mission and in growing its userbase.

mozilla no longer adheres to that original mission and is further attempting to be dishonest about it. given that it's now lost my trust i'll instead actively advocate for moving away from mozilla, in the interest of protecting the privacy of those around me.

the lifeblood of your products and services was the avid community of privacy-minded folks on the ground providing grassroots support for the mission you emblazoned on your flag. with the mission gone there's no reason to rally around.

despicable.

(ps: yes, i did just spend half an hour hunting for any sort of method to contact mozilla about this. for all the time and energy i've spent on mozilla over the years, it was worth conveying my absolute disgust at this betrayal of purpose.)

[adsonly]

This includes processing your data [...]with the content you input in Firefox.

No, no, no!

You shouldn't collect any data in the first place!

And if you do so, it must be an opt in! It must be clear for the user what this data is and that there are no privacy concerns at all. The wording with "browsing data" and "unique identifiers" doesn't help at all. Mozilla should not collect and store "search suggestions" or similar userdata and share it with other companies. And when there is an opt in for that, ist must be clear that this data will be anonymized on client side and deleted after closing Firefox.

Your post makes this even worse, because it makes clear, that you do not understand your user base!

[CAust]

I think your proposed improved statement is not right either.  I suspect that lawyers have gotten the better of Firefox management on possible future liabilities that are not likely going to occur.

You need to be much more specific with your language and clarify the "data use boundaries" here. This is going to damage Firefox if not promptly addressed and effectively made clear.

Get some user help or professional help on getting the language right. If you are going to sell data to survive, or you are under State level pressures, state it publicly. Be clear and open.  The ambivalence of interpretation and intent is far more contagious and damaging.

Long term user of Firefox (decade+). Great browser.  The best over this time.

[FredJupiter]

There is a general and fundamental misunderstanding on the side of Mozilla Corp. and Mozilla.org. I cannot give you a nonexclusive, royalty-free, worldwide license on the content I enter or transfer by using software made by Mozilla in all cases in which I don't have these rights myself, e.g. when I transfer or enter other peoples' or companies' data on their behalf.

And, by the way, why do you want these rights anyway?

"nonexclusive": It's not just a license to the Mozilla organizations but can be sold to third parties.

"royalty-free": I don't get any money and in the event of a legal dispute, the court fees are lower.

"worldwide": You can transfer the data wherever you want. There's an obvious conflict with EU's GDPR.

Sorry, the wording is still hilariously sloppy and the regulation is inacceptable.

[eschatos]

I'm pretty sure that nonexclusive just means that Mozilla isn't the only company that can have a license, not that they can sell it. However, they sneakily do not mention "nontransferable" which I didn't notice at first. As such, they can indeed sell the license to our data. Royalty-free just means that they don't need to pay to use your data.

They also restrict the license to a specific use which is now a lot less vague. They should also restrict it to being used on-device and "as you request" is still a loophole for them. As I request how? What does my request look like? If they actually cared about transparency, they would not try to give us these bull**bleep** non-legally-binding answers and just explain the precise legal reasoning, so that even those among us that don't happen to know international law can follow.

[FredJupiter]

The thinkable use cases don't heal the impossibilities or law conflicts.

[LeonDerBaertige]

This is better but I still don't understand why mozilla needs a license to use all my inputs when I use firefox locally on my computer. For some additional services (which have their own terms anyway)? Sure I can see that might be neccessary, but just using firefox?

[jdmarble]

I want to know that the company that provides my browser does not take the information I put into it and sell it. Your update is telling me, in a very slimy way, that you are, in fact, selling the data that I enter into the browser. This is not due to my “confusion”. If you honestly think that it is you that is confused.

[eschatos]

You didn't address most points, such as:
* Why are you trying to sneak a contract past your users without informed consent?
* Why do you want to use continued use as implicit consent to changes, a practice that is illegal in many parts of the world?
* Why do you need a license to data that never gets uploaded to your servers? I have never heard of software needing a license to all my inputs when it doesn't leave the device. Why is my data leaving the device for basic functionality?
* Why did you previously attempt to get a more-or-less blanket license using vague purposes such as "navigating", "interacting with" and "experiencing" the web "as indicated by our use of Firefox"?
* Why were you trying to ban content that includes graphic depictions of sexuality or violence (which includes, but is not limited to, pornography, movies, TV shows) with your Acceptable Use policy which you tied to the ToS?
* Why were you trying to disallow people the sale of legal but controlled products or services based on your Acceptable Use policy?
* How can you ensure the data you're selling is actually anonymized? The last decades should have shown every somewhat informed person that it can be very easy to deanonymize supposedly anonymous data. Why should we trust you here?
* For the love of god, why have you been so intentionally obtuse and downright offensive up to this point? Oh, people are confused about what you're doing and that's why you had to change the part about licensing to be less vague and remove the Acceptable Use part? We're just all so **bleep**ing stupid and you're geniuses that so respect us and our privacy, I get it. Answer the actual questions, instead of cherry-picking individual points and slightly correcting course while pretending to be these misunderstood angels. **bleep**ing hell.

I'm willing to give you one more opportunity to answer these questions and correct course. If you still fail to take any of this seriously, I will be permanently gone and I'm sure I won't be alone. Also, if this message gets deleted again "as spam", I will take the hint, uninstall all Mozilla products right away and instruct everyone around me to do the same.

[pg_78]

OK, being positive, that paragraph from the Terms of Use is better than it was, and it's good to see some movement in response to feedback. Thank you.

This sentence is still too vague IMO:

It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox.

"Doing as you request" isn't clear enough here. It's not clear what you purposes you think the data is licensed for.

Particularly, there isn't a clear distinction between using Firefox (the application), and using Mozilla services. The only thing that should require a license is the use of Mozilla services (I accept those could be embedded in the browser in the form of features like Search Suggestions).

Simply using the browser, without Mozilla services, should not require a license.

As an analogy, suppose that I buy a bicycle. Does the manufacturer require me to sign terms of use stating that "you grant us a license for the purpose of rotating the wheels when you push the pedals"? Of course not, everyone can see that's absurd.

Now, if the manufacturer also offers a service where I can enable a location tracking device embedded in the frame of the bike, and submit data about my rides to later view in an app - sure, that requires a license and I'd expect to have to agree to the terms of that service.

You might say "but software isn't the same as a bike". Fair point. But does the calculator app in my OS need me to grant it a license to my numerical data "for the purpose of performing arithmetic"? Obviously not.

Similarly, using the browser without interacting with Mozilla services doesn't require a license, and the terms should be made clearer about that.

It's in Mozilla's interests to get this right too. In many jurisdictions, a consumer-facing contract that is overly vague and ambiguous will simply be struck down by a court and rendered null and void. You don't want that, presumably.

[Cvh-123]

• “It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox” is better, but this being there is still worrying. Nothing inputed through the browser should be seen by Mozilla, therefore no license is needed. You need to clarify what is seen by Mozilla that requires such a broad license.
• Stop fussing around and just be ‘honest and transparent’ by adjusting the terms to say “yes, we do sell your data”, and make it clear how when and whether that’s by opt in and if you can opt out. 
• At least acceptable use has gone. 

[ildella]

And there will always be the problem of these lines removed:
https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e#diff-a24e74e4595f...

[pg_78]

Somehow, the starkness of seeing that in git diff format just makes me really sad for what Mozilla used to be and what the web used to be.

[pg_78]

Regarding the Privacy FAQ - please recognise that we aren't just talking about "legal minutiae" here.

When Mozilla dismisses the concerns as "minutiae", it sounds like your view is that "nobody would ever object to their data being sold to advertisers, as long as the data is anonymized and aggregated".

But I do object to that! It's not just about privacy! Even when it doesn't use personal data, online advertising steals our attention and makes the web cringe and corporate. I don't want to be complicit in anything that helps the online advertising economy.

Just like if the city wanted to put a giant neon sign on every street corner in my neighborhood, I'd strongly object to that, and it wouldn't change my mind if you told me "but these neon signs don't use your identifiable data, and you aren't paying for the electricity".

Concretely, what I really want to see in the Privacy Notice is a very clear statement of how I can ensure that none of my data is shared with third parties - regardless of anonymization or aggregation. If I disable the New Tab page, and Search Suggestions, is that enough? I hope so - I even think so - but really I'd need this to be stated in black and white.