July 16th, 2024

For advertising: Firefox now collects user data by default

Firefox 128 introduces controversial default data collection for advertisers through Privacy-Preserving Attribution (PPA). Users must manually opt out, raising transparency and trust issues. Critics question Mozilla's commitment to user privacy.

Read original articleLink Icon
For advertising: Firefox now collects user data by default

Firefox has sparked controversy with its new version, Firefox 128, as it now collects user data for advertisers by default. Despite presenting itself as a champion of data protection, Mozilla has introduced a technology called Privacy-Preserving Attribution (PPA) without clear user consent. Users must manually opt out of this feature, raising concerns about transparency and trust. Critics argue that Mozilla is prioritizing its financial interests over user privacy, especially since the PPA was developed by a company acquired by Mozilla. The technical workings of the PPA involve an aggregation server that anonymizes user data for advertising purposes, leading to skepticism about data security. This move by Firefox has drawn criticism for potentially compromising user trust in a browser provider that promotes data protection while implementing controversial data collection practices. The situation highlights the challenges users face in navigating privacy concerns in the digital landscape, especially with Firefox being a key competitor to Google Chrome.

Related

Mozilla is an advertising company now

Mozilla is an advertising company now

Mozilla acquires Anonym, a privacy-focused advertising company founded by ex-Facebook executives. Integration aims to balance privacy and advertising. Critics question Mozilla's advertising shift, prompting users to explore alternative privacy-centric browsers.

Mozilla is an advertising company now

Mozilla is an advertising company now

Mozilla acquires Anonym, a privacy-focused advertising company backed by former Facebook executives. Mixed reactions arise, questioning Mozilla's direction and suggesting alternative browsers. Concerns about Firefox's handling of content and reputation impact surface.

Firefox 128

Firefox 128

Firefox version 128.0, released on July 9, 2024, brings text translation, personalized search, improved data clearing, streaming in Private Browsing, Privacy Preserving Attribution API, enhanced audio for macOS, security fixes, rendering improvements, developer enhancements, and community contributions. Older Windows and macOS users are advised to switch to Firefox ESR for ongoing support.

Turn off advertising features in Firefox

Turn off advertising features in Firefox

Mozilla enhances Firefox with advertising features to reduce reliance on Google. New Privacy-preserving attribution (PPA) raises privacy concerns but can be disabled. Firefox offers Global Privacy Control and blocks scam ad blockers. Users urged to verify ad blocker effectiveness for privacy.

"Privacy-Preserving" Attribution: Mozilla Disappoints Us yet Again

"Privacy-Preserving" Attribution: Mozilla Disappoints Us yet Again

Mozilla introduced the "Privacy-Preserving Attribution" feature in Firefox 128 with Meta, enabling more tracking for advertisers. Users must manually opt out, sparking privacy and consent concerns. Critics view this as a departure from Mozilla's privacy mission, urging users to disable the feature or switch browsers.

Link Icon 60 comments
By @seanhunter - 5 months
If you want to disable this, instructions are given here[1] but

1) Hamburger menu -> Settings -> Privacy & Security

2) scroll down to the new section entitled "Web Site Advertising Preferences".

3) Make sure the box marked "Allow web sites to perform privacy-preserving ad measurement" is not checked.

[1] https://support.mozilla.org/en-US/kb/privacy-preserving-attr...

By @eco - 5 months
The CTO of Mozilla just posted on /r/firefox about this:

https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_abo...

By @st_goliath - 5 months
While the Wikimedia Foundation is often quoted as having cancer[1], I guess the Mozilla Foundation has Alzheimer's, constantly forgetting who they are and why they are here in the first place.

[1] https://en.wikipedia.org/wiki/User:Guy_Macon/Wikipedia_has_C...

By @kwhitefoot - 5 months
So how do we turn it off?

Found it. Go to settings, type privacy into the search box. The last item under "Firefox Data Collection and Use" is a check box labelled "Allow websites to perform privacy-preserving ad measurement".

It was already unchecked on mine when I looked just now.

By @DaoVeles - 5 months
So where can I donate to Ladybird browser development?

Before anyone tries to respond with it. It is https://donorbox.org/ladybird

By @ranguna - 5 months
https://librewolf.net/

And fallback to Firefox when things don't work. Which is usually on sketchy websites, websites that have heavy bot protection and fingerprinting or ones that use gpu APIs.

By @southernplaces7 - 5 months
One of the few things about Firefox that made me attempt to tolerate its repeatedly slow, shitty performance and tendency to slow my whole device down, was the privacy angle. With that gone, why bother? Might as well use Chrome. At least it's light and fairly quick.
By @stebalien - 5 months
This works by adding noise. Can't an attacker bypass it by boosting the signal? Assuming the attacker can create sybil advertisers/browsers, this should be totally doable:

1. Define some baseline set of M impressions with various ad identifiers and from various sybil advertisers.

2. For each target user, define some set of M marker impressions, also with various ad identifiers and from various and sybil advertisers.

3. Save all impressions (marker + baseline) on a bunch of sybil browsers to get above the reporting baseline with some probability.

4. If/when a target user visits a target website, request a conversion report for each ad/advertiser.

You now have a baseline signal (from the baseline ads/advertisers) and a marker signal (from the marker ads/advertisers). If this is one of your target users, you'd expect their "marker" signal signal to be stronger than the baseline.

By @qwertox - 5 months
Firefox should integrate a tracker-blocker which blocks all ads which rely on executing Javascript as well as profiling-related 3rd-party code snippets, but leaves ad images which are integrated into the page, served exclusively by the owner of the page, and are based on the content offered by the page. Like magazine ads.

Everything else is just agreeing with the advertising industry on their idea that profile-building is fine.

These advertisers nowadays think they have they are entitled to everything, and Firefox just helped them.

By @Archelaos - 5 months
Years ago I had a "Download Firefox" button on my Web-site. I have removed it because of similar incidents in the past. And I stopped recommending Firefox to friends and relatives, because I can no longer do it wholeheartedly. I am not even sure myself, whether it makes a big difference which browser you use nowadays. More out of tradition I am still using Firefox myself, but I know other technologically competent people who shifted away from it. I can only assume that this was for similar reasons: It is felt that Firefox gives no less cause for annoyance than other browsers. When Firefox gradually loses more and more dedicated supporters who become indifferent, I see a rather bleak future for it.
By @silcoon - 5 months
> By offering sites a non-invasive alternative to cross-site tracking, we hope to achieve a significant reduction in this harmful practice across the web.

The value of words is leaving the web.

By @temporarely - 5 months
Enough of this waiting for virtuous entities to address legitimate concerns of the public.

The "ad industry" is a cancer and we need legal protection against this "industry". The solution is political not technical and definitely can not be left to "the market".

Haven't you had enough?

By @justinclift - 5 months
As an alternative, if you're using macOS (or iOS) then Kagi's Orion Browser seems decent:

https://kagi.com/orion/

By @alabhyajindal - 5 months
Greeted by a cookie banner in a different language when I open. I swear cookie banners are the biggest problem facing the internet. We need to do something about this!
By @uyzstvqs - 5 months
What's dumb is that Firefox is not the freedom browser people think it is. Mozilla is a crappy organization. Firefox has extension signing, it's as restrictive as installing apps on iOS where only approved apps can be installed, without a setting to easily disable it. Mozilla can also remotely install extensions by default (opt out) called "experiments" or something. Their anti-tracking is purposefully weak because of their dealings with Google. Now this data collection for ads. They didn't enable DNS-over-HTTPS by default specifically in the UK. And Mozilla leadership is associated with radical left politics, just as an extra.

Maybe check out Brave Browser, LibreWolf or Vivaldi.

By @n3m4c - 5 months
By @JonChesterfield - 5 months
Firefox mobile also won't let me into about:config. So I guess that's the end.

Opera? Other recommendations?

By @eleveriven - 5 months
I think Mozilla Firefox has long been positioned as a browser focused on user privacy and data protection... This decision is indeed a significant breach of trust
By @dpwm - 5 months
The article links to Mozilla’s press release / blog entry about the acquisition of Anonym [0]. It’s pretty dystopian reading. The last three paragraphs and the summary of Anonym are more worrying than anything else I’ve read on this so far:

> This acquisition marks a significant step in addressing the urgent need for privacy-preserving advertising solutions. By combining Mozilla’s scale and trusted reputation with Anonym’s cutting-edge technology, we can enhance user privacy and advertising effectiveness, leveling the playing field for all stakeholders.

I can only interpret this as the urgent need is money, and wants to sell its "scale and trusted reputation". Mozilla has been down this road before. It was not good for them.

> Anonym was founded with two core beliefs: First, that people have a fundamental right to privacy in online interactions and second, that digital advertising is critical for the sustainability of free content, services and experiences. Mozilla and Anonym share the belief that advanced technologies can enable relevant and measurable advertising while still preserving user privacy.

This is some pretty weak wording for a press release. The economics of the situation are that advertising will always trump privacy. Researchers have successfully de-anonymized anonymised data sets, including medical records. Why would these data be any different?

> As we integrate Anonym into the Mozilla family, we are excited about the possibilities this partnership brings. While Anonym will continue to serve its customer base, together, we are poised to lead the industry toward a future where privacy and effective advertising go hand in hand, supporting a free and open internet.

Anonym’s customers are advertisers, right? The same people who for decades poured money into eroding that free and open internet that we had…

> About Anonym: Anonym was founded in 2022 by former Meta executives Brad Smallwood and Graham Mudd. The company was backed by Griffin Gaming Partners, Norwest Venture Partners, Heracles Capital as well as a number of strategic individual investors.

Well, it seems Anonym, Smallwood and Mudd had a nice piece about them written in the Wall Street Journal [1]. From the second paragraph:

> Graham Mudd and Brad Smallwood each spent more than a decade building Meta’s advertising system, which allowed the company to offer granular data about how ad campaigns worked with individual users, often by tracking their web and mobile activity.

[0] https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-t...

[1] https://archive.is/17c0f#selection-5751.0-5751.246

By @genezeta - 5 months
I've been wondering about this whole affair. The thing that got me wondering is this: Is this really interesting for advertisers?

I mean, let's imagine this works as explained -whatever, let's imagine it does and with no downsides even-. Now as far as I can understand this aggregate information ends up producing something like "this particular ad placed here ends up producing this number of conversions". Is this really something an advertiser wants to know? Maybe to some extent, but to me it sounds a lot more like something an advertising platform would want to know. Which is why I'm not surprised by Meta's interest.

To me this feels like a good tool to avoid paying small websites at all for just having ads. Impressions would be finally and completely discarded as something payable. Now for the ads on your site to earn you something at all you need conversions that you can now reliably track. For a site owner to be paid, they'd need to increase the CTR; they can't just "provide ad space", they have to work to earn clicks.

So maybe -probably- I'm way off here. Maybe someone can correct me. But as I see this, this tool seems very specifically made for the big advertising platforms.

By @albeva - 5 months
And there goes my trust in Firefox out the window...

Safari seems to be the only decent, privacy-focused browser left on the market.

Until the Ladybird arrives.

By @EADDRINUSE - 5 months
`sudo echo "127.0.0.1 push.services.mozilla.com incoming.telemetry.mozilla.org" >> /etc/hosts`
By @nabla9 - 5 months
>But how does the PPA actually work? There is an aggregation server between the advertising provider and the users or their data, which anonymizes the information from the individual app browsers. Only then does it make the data available to the participating advertising customers.
By @thinkingemote - 5 months
A user in another thread said that disabling this via config made their user agent also change. Can anyone confirm? Seems unrelated I imagine?

https://news.ycombinator.com/item?id=40959723

By @ChrisArchitect - 5 months
[dupe]

Since this is days old news with lots of discussion (https://news.ycombinator.com/item?id=40952330 and more)

the more recent development is Firefox CTO posting thoughts: https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_abo...

(https://news.ycombinator.com/item?id=40971247)

By @xyproto - 5 months
Will we see a comeback from IceWeasel?
By @sph - 5 months
What do you expect from a company indirectly owned and controlled by Google money?

I can't wait for Ladybird to get good, in a decade realistically, swimming against a massive current of Google pushing its unstandardised nonsense on Chrome, and web developers jumping on the bandwagon, making web standards more and more complex by the day so no one ever is able to catch up.

You can add to the dead internet theory the fact that the Web is now maliciously impossible to recreate and access from scratch if you are unable to compete with the billions Google spend to maintain their hegemony. Heck, even Microsoft found it was more efficient to join Google rather than to try and direct what they laughably call "an open standard." There is more competition to build reusable space rockets than in web browsers.

A sad day, and sadder days await us. Shame of Mozilla, and on the CTO trying to sell this feature as a good thing.

By @sotix - 5 months
Can companies not see how their ads are performing by looking at their income statements? An ad campaign costs x dollars. Widget sales increase by y dollars. Companies were able to run this method for a long time. I think ads have gone way too far. It’s shocking we’ve gotten to the point of this discussion on data collection to fuel ads.
By @Yawrehto - 5 months
I kind of like how this has dominated the 'active' section ever since it started and it's, barely a news story everywhere else.

Honestly I don't have much to add to the conversation. Mozilla made a bad move, Firefox's big thing was privacy and not being Chromium and it's lost the first thing.

By @TimCTRL - 5 months
Do you guys like or trust Vivaldi?
By @INTPenis - 5 months
I wish the article showed us how to disable PPA.[1]

1. https://support.mozilla.org/en-US/kb/privacy-preserving-attr...

By @ManBeardPc - 5 months
Maybe I don't fully understand the technical implementation, but as far as I have read about the implementation this gives personal information to a third-party. This should automatically mean that Firefox would violate European GDPR laws, they clearly need to get consent from the user before collecting anything. Not just a moral issue, but can quickly become a legal one as well.
By @jandrusk - 5 months
Not a good strategy for keeping an already very small user base.
By @AlecSchueler - 5 months
Anyone else feel done with the web? I can't remember the last time I enjoyed a browsing experience. I think this new default might be the end for me.
By @tiffanyh - 5 months
Firefox needs to update their Mission.

Because it's very confusing now.

By @peanut_worm - 5 months
I don’t think Mozilla is trustworthy anymore.
By @eburuschkin - 5 months
Apple enabled the same thing in Safari.

Settings -> Advanced -> Allow Privacy-Preserving Measurement of Ad Effectiveness

By @anordal - 5 months
I see this as an attempt at a lesser evil, and I would support that (see my EME DRM comment), but I have one concern:

Does this new "privacy preserving attribution" feature respect multi-account containers? Or is it somehow not considered necessary, because it's meant to be less invasive than the tracking cookies it's supposed to replace? Call me skeptical for now.

I'm a happy user of multi-account containers, which lets me separate my cookie identities in Firefox. Before, I had to use different browsers for work and private, and yes, it solves this problem, but the best part is that I don't have to worry about tracking cookies, because they aren't tied to my personal accounts: In my experience, I can to a great extent escape the echo chamber I'm in, and the ads I see in it, by just deleting the cookies of my sacrificial default container.

Other than that, considering the status quo – that the web is already an unfriendly GDPR nightmare, I'm positive to the initiative. And because of the power of the default, I can understand that the feature wouldn't likely take off if it was opt-in, so I won't criticize Mozilla for that move either.

By @wkat4242 - 5 months
Says the site that only offers one big button "accept" to its cookies :( :( There's no "Nope".

Edit: Weird, some people seem to have received more options than me. For me there was just one option to accept (Zustimmen) and nothing else. Everything was in German but I read German anyway. I was on mobile though, perhaps this is why? I can't see it again because I already pressed it.

A practice (pay or accept cookies) which was actually ruled in breach with GDPR but many German sites seem to do this somehow.

I agree with the criticism on Firefox but this is very hypocritical. Heise used to be a good company. I even used to subscribe to C'T and iX.

By @slowhadoken - 5 months
An app that alerts you to invasive content in updates like this would be cool.
By @pfzero - 5 months
I wish there was a serious conversation on how a browser can be productivized and make actual profits. I think that model has the best chances of working out over the long-term in guarding user's privacy - at least for those users willing to pay for it.

Most (all?) companies which developed a browser have lax policies on data privacy. At most those are inline with major directives like GDPR. However, it's not in their best interest to protect / not leverage user data. So the real discussion should've been about the set of features that would attract a sufficiently large user base who would pay ~10$ per month subscription in order to make the model sustainable on the long-term.

By @8jef - 5 months
Please give to LadyBird project and be done with it.
By @Timber-6539 - 5 months
At this point Firefox is just a brand for Mozilla to do with as they please. All the talk about a non-Chrome browser with defacto privacy features was just bait to get loyal followers and later on down the road sell them something. Seems ads is just their newest offering.
By @Piraty - 5 months
If 1% of regular Firefox users just donated the equivalent of 10USD per year to mozilla, they would not have the need to find ...eyebrow-raising... ways to earn money.
By @Dwedit - 5 months
How does using uBlock Origin affect this?
By @yamumsahoe - 5 months
how do i donate to the mozilla foundation to support this amazing development?
By @3l3ktr4 - 5 months
I wonder why they claim they need this... Tor seems to be doing fine as an organization without collecting user data? Why maintaining Firefox is much more expensive? I guess the codebase for Firefox is much larger and in the end Tor is a fork of Firefox, right? So maybe they do need much more resources? Not to say I'm not disappointed with Mozilla once again.
By @account42 - 5 months
I always think it's ironic when these things are reported on by websites that force you into accepting their ad tracking which really should be illegal under the GDPR.
By @matheusmoreira - 5 months
Reminder: Mozilla has billions of dollars in the bank. They don't need to do this. They want to.
By @irq-1 - 5 months
> Our hope is that if we develop a good attribution solution, it will offer a real alternative to more objectionable practices like tracking.

There is no negotiating with the advertising industry. No system will stop them from acting unethically to gain an edge.

--

My idea for such a system: random GUID added to each ad. Browser plugin collects GUIDs. Client protects itself with random GUIDs removed and new random GUIDs added. Client sends GUIDs to a Collector they choose. Collectors run client GUIDs against Advertisers lists (bloom filters). Advertisers pay Collectors, and Collectors give to orgs.

Edit: replace GUIDs with 6 random bytes, so the existence of an id is not proof of it's being viewed. it needs to be plausible that the client added an id randomly, and that's not the case with a GUID.

By @hulk_ - 5 months
Just installed Chrome again. I loved everything about the idea behind Mozilla but the browser is quite not useable these days. Really sad.