An Update on our Terms of Use

[AshleyT]

On Wednesday we shared that we’re introducing a new Terms of Use (TOU) and Privacy Notice for Firefox. Since then, we’ve been listening to some of our community’s concerns with parts of the TOU, specifically about licensing. Our intent was just to be as clear as possible about how we make Firefox work, but in doing so we also created some confusion and concern. With that in mind, we’re updating the language to more clearly reflect the limited scope of how Mozilla interacts with user data.

Here’s what the new language will say:

You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content. 

In addition, we’ve removed the reference to the Acceptable Use Policy because it seems to be causing more confusion than clarity.

Privacy FAQ

We also updated our Privacy FAQ to better address legal minutia around terms like “sells.” While we’re not reverting the FAQ, we want to provide more detail about why we made the change in the first place. Check out the full blog post to read more.

[seva]

"It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content. "  
Sorry, but this wording means that you will get the right to sell t-shirts with my artwork if I send artwork using Firefox. You will not get ownership of my drawing, but you will get a license to use it in any way, i.e. you can print it on mugs, t-shirts, make posters, etc.

[LSD123]

Thought you didn't sell our data and NEVER will? Been using Firefox for 15+ years. Never using it again.

[firebird]

Overall the language is much better. For the purpose of doing as you request is much clearer and more reassuring language.

It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox.

Is this limited to a few key areas like Search Suggestions and New Tab? It would be good to enumerate every use of our information instead of providing a blanket license to use any of it. The new version mostly seems to say this, but it would be good for it to use the word "only".

A short bullet-point summary of all the data usage Mozilla gives itself rights to conduct from the privacy policy would also be great, as the privacy policy is a lot to read.

I guess this section would actually be pretty similar to that bullet point list? https://www.mozilla.org/en-US/privacy/firefox/#lawful-bases

(To other commenters, please avoid personally attacking employees at Mozilla.)

[seva]

I think if you had trusted the community and honestly said that you were faced with the choice between going bankrupt and launching your own ad service, the community might have supported you.

Instead of forcing the community, you could have given the community a choice, like you give the community a choice with statistics collection. When update, there will be a window with a choice of two options:
1. I want to support Mozilla, so please enable Mozilla's ad service.
2. Do not enable Mozilla's ad service. I am not going to support Mozilla in this way.

[Deadoon]

As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”  

---

That doesn't seem all that different from a layman's comprehension of selling data to me.

[yolo1]

You clearly hide something about the new IA features.
Please put this in a plugin first before deploying these features. If your plugin becomes popular, integrate it into your core software. Stop using your core userbase to capitalize on it.

[Xerxes01]

Are Mozilla's leaders possibly alienating their long-standing, privacy-conscious users with these questionable decisions?

I'm telling you if Firefox doesn't revert to its old, user-respecting TOS, they're practically begging for its downfall!

[joeyh]

Will Mozilla be firing the incompetent managers and lawyers who drafted the overly broad and badly written original version?

Or was this a precalculated maneuver, leading with the overly broad land grab and backpedaling right to where you wanted to be all along?

[tpdi]

In every communication about this, you've been careful to include the parenthetical qualification '(in the way that most people think about “selling data”)'

> TL;DR Mozilla doesn’t sell data about you (in the way that most people think about “selling data”), and we don’t buy data about you.

When I see something repeated verbatim in *every* communication, I assume that's because a lawyer has said "it's essential that you always include this."

And it's weaselly. "In the way that most people think" is subjective and doesn't actually specify what that thinking is.

It also implies that even if "most people" don't consider it selling data, *some people* do consider it selling data. 

So, in other words, 'Mozilla doesn’t sell data about you (in the way that most people think about “selling data”)' can be and probably should be interpreted as a cleverly obscurantist way to say "Mozilla does sell data about you (just not in the way that most people think about 'selling data')."

My guess is a lawyer has told you to always make sure you phrase it in this way, in order to publicly appear to say "we don't sell users' data" while in fact *not*, technically, claiming that you don't sell user data.

So who came up with the qualification "(in the way that most people think about 'selling data')"?

And were you, Ashley, instructed to always include that qualification?

What's *not* included in "the way most people think about 'selling data'"?

And of those not included ways, which ways are Mozilla reserving the right to sell our data?

[user9164967254]

This response is wholly inadequate.  Although some of the points of https://connect.mozilla.org/t5/discussions/information-about-the-new-terms-of-use-and-updated-privac... have been addressed, many have not.  Also, there are now even more issues with the new post:

---

The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”

---

That is just about exactly how I would define "sharing data".

---

In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners, including our optional ads on New Tab and providing sponsored suggestions in the search bar.

---

So you are saying you have been violating your promise for a long time now.  Uhhhh, thanks for bringing it to my attention?

---

Whenever we share data with our partners, we put a lot of work into making sure that the data that we share is stripped of potentially identifying information, or shared only in the aggregate, or is put through our privacy preserving technologies (like OHTTP).

---

Cool.  Still violates your previous promise.  Being less evil than Google does not absolve Mozilla of all wrongdoing.

I've been daily driving Firefox since I was a young child, but it's time for me to hop out of the pot.

---

---

[tpdi]

From <s>Dan Brown's</s> Ajit Varmas's blog post:

> The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.” 

So, the Mozilla Foundation, founded in California, and the Mozilla Corporation, headquartered in California, intend to do things that under California law are considered to be the sale of data, as passed by a majority of the California Assembly and signed by the California governor into law, but Mozilla wants to pretend those things are not a sale of data?

As Abe Lincoln asked, how many legs does a dog have, if I call its tail a leg?

Mozilla, a California corporation, doesn't get to redefine California law to hide inconvenient truths.

Just admit it: "we intend to do things that under California law constitute the sale of users' data. But under the laws of Belarus, Kazakhstan, and the Democratic Republic of the Congo, those things are totally not the sale of user data, so we're completely in the clear, trust us!"

Some super-clever Wharton School MBA came up with this, right?

[i430VX]

I am happy to see some things resolved in this clarification. However, I am in agreement with Firebird above (and presumably others) that it would be nice to see a more solid, exhaustive list (to the extent possible) of what is meant by the license part. The wording "as you request" is still, in my layperson's eyes, still somewhat too much open to interpretation to make me feel comfortable about it.

[EmmanuelMess]

From the blog entry:

> Firefox also shows its own search suggestions based on information stored on your local device (including recent search terms, open tabs, and previously visited URLs). These suggestions may include sponsored suggestions from Mozilla’s partners, relevant content from common internet resources (such as Wikipedia), or relevant URLs that are popular in your country. Mozilla processes certain technical and interaction data, such as how many searches you perform, how many sponsored suggestions you see and whether you interact with them. Mozilla's partners receive de-identified information about interactions with the suggestions they've served. You can enable or disable Search suggestions at any time.

There is a problem with this wording, it implies that even when the seach suggestions are disabled, the data can be shared with Mozilla or 3rd parties. I don't think this would be acceptable. I would recommend a blanket "all data sharing with 3rd parties can be disabled".

Also here:

> Learn more about how we categorize searches, including how to opt out.

I don't want to opt out of the feature per-se, I would want to opt out of the *data sharing* and *large scale mining*.

[wwahammy]

I'll copy in what I sent to the Mozilla Foundation folks when they asked me for a donation:

Please pass this along to your board members and your executive director. Seriously. Please.

I've been a Mozilla user and Firefox advocate for a decade plus. I've donated to the Foundation. I've advocated for Common Voice and encouraged people to contribute to it. I stuck with and supported you all no matter what.

After your fully owned subsidiary's Terms of Use fiasco this week, it's insulting to ask me to donate. The lack of any sort of consideration of your customers and users and donors is just astounding. After all of this, I'm done with Mozilla Corporation, Foundation, etc, etc. I'm leaving Firefox, I'm writing off the foundation and want nothing to do with with you. I can't figure out why every member of your organization continually despises your constitutents but I'll help you out, I won't be a user, I won't be donor and I will ignore Mozilla's very existence.

[welyr]

The definition of "selling data" under the "CCPA" which is referenced absolutely is what I would consider selling data.  

They may tweek this or that in these terms, that privacy policy could belong to any for profit company that harvests people's data for money.  It clearly states they are using our data to serve up targeted ads.  These are basically Mozilla's documents of surrender to surveillance capitalism.

Also all my previous comments that they would still need to turn over any data they collect in response to "Lawful Requests" still stands (and that doesn't meant the ones making such requests would necessarily be "the good guys" from our point of view).  My concerns about how this makes Firefox unsuitable for individuals who are serious about privacy still stand.

[Chris-Winters]

@AshleyT 

I just want to point out your original post got 6 "Kudos" and 244 replies... if you weren't aware this is called "getting ratioed". It means the content of the post was quite unpopular and whoever instructed you to say this should rethink their strategy here, and then begin training their replacement because this is a colossal failure. But I'm certain Mozilla will just call us all bigots, spend another $10 Million on another conference for 7 blue haired they/thems and a disabled xe/xir with a buzzword salad for a name and keep chugging along ignoring the massive fire burning the whole building down around them.

You're not dealing with gullible and impressionable first graders. A lot of us were building the foundations of the internet before you were even born. If you think this move will lead to success for Mozilla you've all become delusional. Snap out of it. 3% browser market share and falling. If that were a stock price the shareholders would be jumping ship before you inevitably filed Chapter 11 and declared bankruptcy, and then they'd be discussing options for lawsuits with their attorneys.

Let me rephrase that in case my meaning isn't completely understood;

MOZILLA. IS. NO. LONGER. POPULAR. ENOUGH. TO. GET. AWAY. WITH. THIS! Mozilla simply doesn't have enough good will left over to recover from this.

As a reminder. Firefox is completely open source, which means a hard fork is just a few clicks away. We don't need Mozilla for Firefox to continue... but Mozilla certainly needs Firefox.

But let me try to be somewhat helpful here, because contrary to what you might think based on this and other comments I've made I don't actually want to see Mozilla disappear.

Let's begin with the fact that all of this broad legalese is spread across 3 or 4 separate legal documents, that all reference each other multiple times so the user is expected to consecutively read and agree to at least 3 legal agreements that all contain overly broad and intentionally confusing legal speak... and somehow come out with a precise understanding of what we are permitting Mozilla to do with precisely what data and exactly when and for how long?

"This includes processing your data as we describe in the Firefox Privacy Notice."

Why can't this section include the relevant part of the "Privacy Notice"?

Next, let's tackle the next part.

"It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox."

Explain, precisly, why Mozilla needs a "nonexclusive, royalty-free, worldwide license" to any "content" users input into Firefox. The example you gave in your first attempt to "clarify" this mentioned searching. Well, as pointed out by myself and others, Firefox currently redirects search terms to the users selected default search engine and you currently DO NOT need any "nonexclusive, royalty-free, worldwide license" for this functionality to work.

Allow me to use an analogy to precisely spell out how I interpret this part of this sections.

I'm going to need you to hand me a key to your house, and grant me "nonexclusive, royalty-free, worldwide license" to enter your house "for the purpose of doing as you request" but don't worry, I totally won't ever go into your house without your knowledge or permission...

See the problem here? If you want me to go into your home to do anything, you can totally do that already without having to give me the key and trusting that I won't simply walk in whenever I want. You can open your own door and invite me in, you can be present while I do what you asked of me, and you can watch me leave afterwards and lock the door behind me when I do. I don't actually need a key to your home. But you're asking us for the keys to our data? And so far the justification for it has been "Just trust me bro"?

Do you get it yet? You have to understand this. There is no possible way you don't know what you're doing at this point. I'm all out of benefit of the doubt for you.

[SirWolf]

You want to train our data for AI, that's what you're doing. No matter how you formulate it, the overall message is the same. No matter why you're "stealing" our data, it's disgusting. A browser is our entry point to accessing the Internet, not your entry point to legalized spyware. The Firefox days are over. Stop deceiving us, it's not gonna work.

[Serg1]

I am not convinced, at all - it still sounds vague, unintuitive and unnecessary. I chose FF exactly because of "Nope, never, under no circumstances for no intents or purposes we do not collect, store, process on the fly, pass or use your data, other than to serve your explicit request, for example show you the web page you accessed or autofill the email address you asked us to save. Period."

This is what I want to see, so there would be no place for any shenanigans like 'partners', 'analytics', 'recommendations', 'ai training' and other BS.
Please make it right, and make it right right now, otherwise I personally will be looking for another browser, even though I hate the idea, but what choice do you leave me...

[IloveFirefox]

Mozilla did not need my data before. Mozilla doesn't need it now. Nor will it ever.
My data is between ME and the WEBSITE I CHOOSE TO VISIT. Not the browser.
Privacy Preserving Advertising is a delusional solution at best.

Mozilla better correct course immediately. Otherwise enjoy your downfall. You certainly earned it.

[soleniae]

this is heinous.

i've been an avid proponent for the mozilla ecosystem - not agreeing with all actions and positions but broadly firmly in support of the mission and in growing its userbase.

mozilla no longer adheres to that original mission and is further attempting to be dishonest about it. given that it's now lost my trust i'll instead actively advocate for moving away from mozilla, in the interest of protecting the privacy of those around me.

the lifeblood of your products and services was the avid community of privacy-minded folks on the ground providing grassroots support for the mission you emblazoned on your flag. with the mission gone there's no reason to rally around.

despicable.

(ps: yes, i did just spend half an hour hunting for any sort of method to contact mozilla about this. for all the time and energy i've spent on mozilla over the years, it was worth conveying my absolute disgust at this betrayal of purpose.)