One of the most privacy focused web browsers, Firefox, is at the centre of a privacy complaint from Austria’s Noyb
Vienna-based privacy group Noyb (None Of Your Business) has levelled a privacy complaint against an unlikely target – Mozilla’s Firefox.
Noyb’s complaint alleged that in a recent Firefox update, “Mozilla seems to have taken a leaf out of Google’s playbook: without directly telling its users” that centres over a “secretly enabled” Privacy Preserving Attribution (PPA).
The privacy complaint – filed with the Austrian data protection authority – comes as something of a surprise, considering Mozilla has repeatedly sought to strengthen the privacy capabilities of its Firefox browser, including the blocking of third-party cookies.
Noyb allegations
Noyb was founded by noted privacy activist Max Schrems, and most recently it filed complaints against X (formerly Twitter) in nine European countries over its use of Europeans’ data to train artificial intelligence (AI) tools.
In June it filed a complaint against Alphabet for allegedly tracking users of its Chrome browser, and has also filed many other complaints against big tech companies over the years.
But now the group alleges that Mozilla’s newly enabled Privacy Preserving Attribution (PPA) is “similar to Google’s (failed) Privacy Sandbox,” and that “this turned the browser into a tracking tool for websites. The idea: instead of placing traditional tracking cookies, websites have to ask Firefox to store information about people’s ad interactions in order to receive the bundled data of multiple users.”
According to Noyb, Mozilla claims that the development of “privacy preserving attribution” improves user privacy by allowing ad performance to be measured without individual websites collecting personal data.
“In reality, part of the tracking is now done directly in Firefox,” the group alleges. “While this may be less invasive than unlimited tracking, which is still the norm in the US, it still interferes with user rights under the EU’s GDPR. In reality, this tracking option doesn’t replace cookies either, but is simply an alternative – additional – way for websites to target advertising.”
Ad measuring tool?
“Mozilla has just bought into the narrative that the advertising industry has a right to track users by turning Firefox into an ad measurement tool,” said Felix Mikolasch, data protection lawyer at noyb.
“While Mozilla may have had good intentions, it is very unlikely that ‘privacy preserving attribution’ will replace cookies and other tracking tools. It is just a new, additional means of tracking users.”
Noyb especially took issue with the allegation that “Mozilla has turned on its ‘privacy preserving attribution’ by default. Users have not been informed about this move, nor have they been asked for their consent to be tracked by Firefox. The feature isn’t even mentioned in Mozilla’s data protection policies.”
It said the only way for users to turn it off is to find the opt-out function in a sub-menu of the browser’s settings. It also took issue with a Mozilla developer justification of the move by claiming that users can’t make an informed decision.
“It’s a shame that an organisation like Mozilla believes that users are too dumb to say yes or no,” Felix Mikolasch, data protection lawyer at noyb. “Users should be able to make a choice and the feature should have been turned off by default.”
Mozilla’s response
But Christopher Hilton, Mozilla’s director of policy and corporate communications told Silicon UK that PPA is currently a limited test and has not been activated, and no end-user data has been recorded or sent.
“There’s no question we should have done more to engage outside voices in our efforts to improve advertising online, and we’re going to fix that going forward,” said Hilton. “While the initial code for PPA was included in Firefox 128, it has not been activated and no end-user data has been recorded or sent.”
“The current iteration of PPA is designed to be a limited test only on the Mozilla Developer Network website,” Hilton said.
“We continue to believe PPA is an important step toward improving privacy on the internet and look forward to working with NOYB and others to clear up confusion about our approach.”
