European digital rights group NOYB (None Of Your Enterprise) has filed a privateness grievance with the Austrian knowledge safety watchdog (DSB) in opposition to Mozilla, alleging the corporate makes use of a Firefox privateness characteristic (enabled with out consent) to trace customers’ on-line habits.
The characteristic, referred to as “Privateness-Preserving Attribution” (PPA) and collectively developed with Meta (previously Fb), was introduced in February 2022 and was routinely enabled for all customers in Firefox model 128, launched in July.
NOYB’s grievance claims that, regardless of its title, Mozilla makes use of the characteristic to trace Firefox person habits throughout web sites.
“Opposite to its reassuring title, this expertise permits Firefox to trace person behaviour on web sites. In essence, the browser is now controlling the monitoring, relatively than particular person web sites,” the privateness advocate group mentioned.
“Whereas this is likely to be an enchancment in comparison with much more invasive cookie monitoring, the corporate by no means requested its customers in the event that they wished to allow it. As an alternative, Mozilla determined to show it on by default as soon as folks put in a current software program replace.”
In accordance with NOYB, PPA allows Firefox to retailer knowledge on customers’ advert interactions and bundle that info for advertisers. Mozilla claims this method enhances privateness by measuring advert efficiency with out particular person web sites gathering private knowledge.
Nonetheless, NOYB says that a part of the monitoring is completed in Firefox, interfering with person rights underneath the EU’s Common Knowledge Safety Regulation (GDPR).
“Mozilla has simply purchased into the narrative that the promoting trade has a proper to trace customers by turning Firefox into an advert measurement software,” Felix Mikolasch, knowledge safety lawyer at NOYB, added.
“Whereas Mozilla could have had good intentions, it is rather unlikely that ‘privateness preserving attribution’ will change cookies and different monitoring instruments. It’s only a new, further technique of monitoring customers.”
In a July assist doc, Mozilla described PPA as a “non-invasive different to cross-site monitoring,” designed to assist advertisers assess the effectiveness of their adverts with out sharing info on customers’ on-line habits.
Mozilla additionally insists that PPA would not share shopping info with third events, together with the corporate itself, and that advertisers solely obtain aggregated knowledge about advert efficiency.
“PPA doesn’t contain web sites monitoring you. As an alternative, your browser is in management. This implies sturdy privateness safeguards, together with the choice to not take part,” Mozilla says.
“PPA doesn’t contain sending details about your shopping actions to anybody. This contains Mozilla and our DAP associate (ISRG). Advertisers solely obtain mixture info that solutions fundamental questions concerning the effectiveness of their promoting.”
Firefox customers can disable the PPA characteristic by opening the online browser’s Privateness & Safety settings and unchecking the choice labeled “Enable web sites to carry out privacy-preserving advert measurement.”
“There is no query we should always have performed extra to have interaction outdoors voices in our efforts to enhance promoting on-line, and we’re going to repair that going ahead,” a Mozilla spokesperson informed BleepingComputer on Wednesday.
“Whereas the preliminary code for PPA was included in Firefox 128, it has not been activated and no end-user knowledge has been recorded or despatched.
“The present iteration of PPA is designed to be a restricted check solely on the Mozilla Developer Community web site. We proceed to consider PPA is a vital step towards enhancing privateness on the web and sit up for working with NOYB and others to clear up confusion about our strategy.”