An Update on our Terms of Use

[AshleyT]

On Wednesday we shared that we’re introducing a new Terms of Use (TOU) and Privacy Notice for Firefox. Since then, we’ve been listening to some of our community’s concerns with parts of the TOU, specifically about licensing. Our intent was just to be as clear as possible about how we make Firefox work, but in doing so we also created some confusion and concern. With that in mind, we’re updating the language to more clearly reflect the limited scope of how Mozilla interacts with user data.

Here’s what the new language will say:

You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content. 

In addition, we’ve removed the reference to the Acceptable Use Policy because it seems to be causing more confusion than clarity.

Privacy FAQ

We also updated our Privacy FAQ to better address legal minutia around terms like “sells.” While we’re not reverting the FAQ, we want to provide more detail about why we made the change in the first place. Check out the full blog post to read more.

[seva]

"It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content. "  
Sorry, but this wording means that you will get the right to sell t-shirts with my artwork if I send artwork using Firefox. You will not get ownership of my drawing, but you will get a license to use it in any way, i.e. you can print it on mugs, t-shirts, make posters, etc.

[LSD123]

Thought you didn't sell our data and NEVER will? Been using Firefox for 15+ years. Never using it again.

[firebird]

Overall the language is much better. For the purpose of doing as you request is much clearer and more reassuring language.

It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox.

Is this limited to a few key areas like Search Suggestions and New Tab? It would be good to enumerate every use of our information instead of providing a blanket license to use any of it. The new version mostly seems to say this, but it would be good for it to use the word "only".

A short bullet-point summary of all the data usage Mozilla gives itself rights to conduct from the privacy policy would also be great, as the privacy policy is a lot to read.

I guess this section would actually be pretty similar to that bullet point list? https://www.mozilla.org/en-US/privacy/firefox/#lawful-bases

(To other commenters, please avoid personally attacking employees at Mozilla.)

[seva]

I think if you had trusted the community and honestly said that you were faced with the choice between going bankrupt and launching your own ad service, the community might have supported you.

Instead of forcing the community, you could have given the community a choice, like you give the community a choice with statistics collection. When update, there will be a window with a choice of two options:
1. I want to support Mozilla, so please enable Mozilla's ad service.
2. Do not enable Mozilla's ad service. I am not going to support Mozilla in this way.

[Deadoon]

As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”  

---

That doesn't seem all that different from a layman's comprehension of selling data to me.

[yolo1]

You clearly hide something about the new IA features.
Please put this in a plugin first before deploying these features. If your plugin becomes popular, integrate it into your core software. Stop using your core userbase to capitalize on it.

[Xerxes01]

Are Mozilla's leaders possibly alienating their long-standing, privacy-conscious users with these questionable decisions?

I'm telling you if Firefox doesn't revert to its old, user-respecting TOS, they're practically begging for its downfall!

[joeyh]

Will Mozilla be firing the incompetent managers and lawyers who drafted the overly broad and badly written original version?

Or was this a precalculated maneuver, leading with the overly broad land grab and backpedaling right to where you wanted to be all along?

[tpdi]

In every communication about this, you've been careful to include the parenthetical qualification '(in the way that most people think about “selling data”)'

> TL;DR Mozilla doesn’t sell data about you (in the way that most people think about “selling data”), and we don’t buy data about you.

When I see something repeated verbatim in *every* communication, I assume that's because a lawyer has said "it's essential that you always include this."

And it's weaselly. "In the way that most people think" is subjective and doesn't actually specify what that thinking is.

It also implies that even if "most people" don't consider it selling data, *some people* do consider it selling data. 

So, in other words, 'Mozilla doesn’t sell data about you (in the way that most people think about “selling data”)' can be and probably should be interpreted as a cleverly obscurantist way to say "Mozilla does sell data about you (just not in the way that most people think about 'selling data')."

My guess is a lawyer has told you to always make sure you phrase it in this way, in order to publicly appear to say "we don't sell users' data" while in fact *not*, technically, claiming that you don't sell user data.

So who came up with the qualification "(in the way that most people think about 'selling data')"?

And were you, Ashley, instructed to always include that qualification?

What's *not* included in "the way most people think about 'selling data'"?

And of those not included ways, which ways are Mozilla reserving the right to sell our data?

[user9164967254]

This response is wholly inadequate.  Although some of the points of https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privac... have been addressed, many have not.  Also, there are now even more issues with the new post:

---

The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”

---

That is just about exactly how I would define "sharing data".

---

In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners, including our optional ads on New Tab and providing sponsored suggestions in the search bar.

---

So you are saying you have been violating your promise for a long time now.  Uhhhh, thanks for bringing it to my attention?

---

Whenever we share data with our partners, we put a lot of work into making sure that the data that we share is stripped of potentially identifying information, or shared only in the aggregate, or is put through our privacy preserving technologies (like OHTTP).

---

Cool.  Still violates your previous promise.  Being less evil than Google does not absolve Mozilla of all wrongdoing.

I've been daily driving Firefox since I was a young child, but it's time for me to hop out of the pot.

---

---

[tpdi]

From <s>Dan Brown's</s> Ajit Varmas's blog post:

> The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.” 

So, the Mozilla Foundation, founded in California, and the Mozilla Corporation, headquartered in California, intend to do things that under California law are considered to be the sale of data, as passed by a majority of the California Assembly and signed by the California governor into law, but Mozilla wants to pretend those things are not a sale of data?

As Abe Lincoln asked, how many legs does a dog have, if I call its tail a leg?

Mozilla, a California corporation, doesn't get to redefine California law to hide inconvenient truths.

Just admit it: "we intend to do things that under California law constitute the sale of users' data. But under the laws of Belarus, Kazakhstan, and the Democratic Republic of the Congo, those things are totally not the sale of user data, so we're completely in the clear, trust us!"

Some super-clever Wharton School MBA came up with this, right?

[i430VX]

I am happy to see some things resolved in this clarification. However, I am in agreement with Firebird above (and presumably others) that it would be nice to see a more solid, exhaustive list (to the extent possible) of what is meant by the license part. The wording "as you request" is still, in my layperson's eyes, still somewhat too much open to interpretation to make me feel comfortable about it.

[EmmanuelMess]

From the blog entry:

> Firefox also shows its own search suggestions based on information stored on your local device (including recent search terms, open tabs, and previously visited URLs). These suggestions may include sponsored suggestions from Mozilla’s partners, relevant content from common internet resources (such as Wikipedia), or relevant URLs that are popular in your country. Mozilla processes certain technical and interaction data, such as how many searches you perform, how many sponsored suggestions you see and whether you interact with them. Mozilla's partners receive de-identified information about interactions with the suggestions they've served. You can enable or disable Search suggestions at any time.

There is a problem with this wording, it implies that even when the seach suggestions are disabled, the data can be shared with Mozilla or 3rd parties. I don't think this would be acceptable. I would recommend a blanket "all data sharing with 3rd parties can be disabled".

Also here:

> Learn more about how we categorize searches, including how to opt out.

I don't want to opt out of the feature per-se, I would want to opt out of the *data sharing* and *large scale mining*.

[wwahammy]

I'll copy in what I sent to the Mozilla Foundation folks when they asked me for a donation:

Please pass this along to your board members and your executive director. Seriously. Please.

I've been a Mozilla user and Firefox advocate for a decade plus. I've donated to the Foundation. I've advocated for Common Voice and encouraged people to contribute to it. I stuck with and supported you all no matter what.

After your fully owned subsidiary's Terms of Use fiasco this week, it's insulting to ask me to donate. The lack of any sort of consideration of your customers and users and donors is just astounding. After all of this, I'm done with Mozilla Corporation, Foundation, etc, etc. I'm leaving Firefox, I'm writing off the foundation and want nothing to do with with you. I can't figure out why every member of your organization continually despises your constitutents but I'll help you out, I won't be a user, I won't be donor and I will ignore Mozilla's very existence.

[welyr]

The definition of "selling data" under the "CCPA" which is referenced absolutely is what I would consider selling data.  

They may tweek this or that in these terms, that privacy policy could belong to any for profit company that harvests people's data for money.  It clearly states they are using our data to serve up targeted ads.  These are basically Mozilla's documents of surrender to surveillance capitalism.

Also all my previous comments that they would still need to turn over any data they collect in response to "Lawful Requests" still stands (and that doesn't meant the ones making such requests would necessarily be "the good guys" from our point of view).  My concerns about how this makes Firefox unsuitable for individuals who are serious about privacy still stand.