4 ms·

Quick breakdown of what's going on here (I work at Mozilla, and have worked on the Add-ons site in the past): The "Get Add-ons" view in Firefox is an iframe to

by potch 9y ago

Quick breakdown of what's going on here (I work at Mozilla, and have worked on the Add-ons site in the past): The "Get Add-ons" view in Firefox is an iframe to a page hosted by addons.mozilla.org. AMO, as all Mozilla sites, use GA to collect aggregate visitor statistics. We negotiated a special contract with Google [1] to only collect a subset of data and that that data is only used for statistical purposes. Google Analytics is only loaded when this view is loaded, and is not otherwise "inside" Firefox. I filed an issue [2] to make sure that our privacy policy is linked from the Get Add-ons view so users can be better informed. Mozilla tries to walk a very thin wire to ensure that we have the data we need to make sure our products are working properly without being intrusive, and to let concerned users opt-out of even that baseline data collection. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14 https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14 [2] https://github.com/mozilla/addons-frontend/issues/2789 https://github.com/mozilla/addons-frontend/issues/2789

kuschku 9y ago
That’s all fine and nice, but how did Mozilla Legal approve this in the first place? It’s obvious this violates both the so-called "Cookie Law" and the Google Analytics ToS, as both require any page with tracking to specifically tell the user that they will track the user. And the so-called "Cookie Law" goes even further, and requires it to be directly done in a modal. How did Mozilla, a company saying they fight for privacy, approve something that does not even meet the absolute minimum bar for privacy, the actual privacy laws?
- eli 9y ago
  It's not "obvious" that it violates either of those. The general consensus is that normal GA tracking alone does not meet the standards to trigger either the EU or the stricter Dutch cookie notification requirements since they are using first-party cookies not tied to PII and don't follow you across sites. And that's assuming a standard GA snippet, not the smaller subset of data Mozilla is collecting here. And the GA ToS require you to have a privacy policy and to make users aware of it. It doesn't require a link on every page. You already agreed to the Mozilla privacy policy as part of the Firefox install process, right?
  - gcp 9y ago
    The general consensus is that normal GA tracking alone does not meet the standards to trigger either the EU or the stricter Dutch cookie notification requirements since they are using first-party cookies not tied to PII and don't follow you across sites Do you have a good reference for this? Especially the "don't follow you across sites" seems weird as Google will end up collecting hits from the same IP/browser/etc combo across sites, which trivially allows following.
    - amichal 9y ago
      I don't know what firefox addon pages does (and i see they have a special arrangement) and am not taking sides but for IP at least there is an option partially scrub it before it gets to disk at Google. https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en Edit: what do we think?
    - amichal 9y ago
      Found a source for this opinion. Here [1] are instructions from the Dutch Government's "Personal Data Authority" on setting up GA in compliance with their laws in a way that does (did?) not require an explicit notice. See [2] for an explanation in english [1] https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/handleiding_privacyvriendelijk_instellen_google_analytics_1.pdf https://autoriteitpersoonsgegevens.nl/sites/default/files/at... [2] https://www.iabeurope.eu/eucookielaws/nl/ https://www.iabeurope.eu/eucookielaws/nl/ TLDR: If you use the following code. You are fine to use GA without a notice under Dutch law. ga('set', 'forceSSL', true); ga('set', 'anonymizeIp', true);
      - gcp 9y ago
        Thank you! This is really useful.
        kuschku 9y ago
        Be aware, this changes in 316 days, when the EU GDPR comes into force, and makes even for those cases opt-in required.
- lucideer 9y ago
  I'm not sure what the "Mozilla Legal" process is, but this thread[0] from 2012 seems to be a recurring source of authority on decision-making around this, from my reading of Bugzilla. This is what tofumatt was referring to when closing this Github thread. [0] https://groups.google.com/forum/#!msg/mozilla.governance/9IQvIubDOXU/0tWVVlrUJOQJ https://groups.google.com/forum/#!msg/mozilla.governance/9IQ...
TekMol 9y ago
The "Get Add-ons" view in Firefox is an iframe Please don't hide behind technical details. If click something in the browser and it causes Google to be notified, then you have send data about me to Google. Without my consent. privacy policy is linked from the Get Add-ons view Nobody reads those and you know it. The reason people use Firefox is to not get tracked by Google. Honestly, you hugely fucked up with this one. You lost a massive amount of trust with me that took years to grow.
- stinkytaco 9y ago
  > Nobody reads those and you know it. The reason people use Firefox is to not get tracked by Google. If you care about privacy, blind trust is never something you should have. This has all the trappings of a mistake to me. A group of developers responsible for developing one area (the add-ons page), was not considering the impact it might have on another (the browser developers). Perhaps they should find a different solution, but it rings hollow to argue that a privacy conscious user shouldn't be expected to have read the privacy policy.
  - kuschku 9y ago
    Someone submitted a PR to Mozilla to fix this, and the Mozilla devs closed it, arguing that Google Analytics does not count as tracking. See: https://github.com/mozilla/addons-frontend/pull/2787#issuecomment-314872289 https://github.com/mozilla/addons-frontend/pull/2787#issueco... The TOR devs are fixing this part in their browser, and their comment was: > Disallow `about:addons` unless the extensions directory is volatile, because regardless of what Mozilla PR says about respecting privacy, loading Google Analytics in a page that gets loaded as an IFRAME as part of an `about:` internal page, is anything but.
    - stinkytaco 9y ago
      Check that issue again. Before you posted this they agreed and pushed the issue to the add-ons team. Do not track should turn off Analytics. But that's not my point. As I said, they could well be wrong, but it's over the top to argue that it's Mozilla's fault for disclosing this in the privacy policy (which apparently no one reads). If you are so privacy conscious that this bothers you that much, the privacy policy should be required reading.
proactivesvcs 9y ago
May I suggest that Mozilla stops walking a "very thin line" between telemetry and user privacy and instead walks beside a very thick line, on the side of user privacy. This incident has proven how easy it is to step off a very thin line into territory that your users are disgusted by. Choose to walk the thick line and even if you stumble, you will not fall.

by potch 9y ago

kuschku 9y ago

That’s all fine and nice, but how did Mozilla Legal approve this in the first place? It’s obvious this violates both the so-called "Cookie Law" and the Google Analytics ToS, as both require any page with tracking to specifically tell the user that they will track the user. And the so-called "Cookie Law" goes even further, and requires it to be directly done in a modal. How did Mozilla, a company saying they fight for privacy, approve something that does not even meet the absolute minimum bar for privacy, the actual privacy laws?

eli 9y ago
It's not "obvious" that it violates either of those. The general consensus is that normal GA tracking alone does not meet the standards to trigger either the EU or the stricter Dutch cookie notification requirements since they are using first-party cookies not tied to PII and don't follow you across sites. And that's assuming a standard GA snippet, not the smaller subset of data Mozilla is collecting here. And the GA ToS require you to have a privacy policy and to make users aware of it. It doesn't require a link on every page. You already agreed to the Mozilla privacy policy as part of the Firefox install process, right?
- gcp 9y ago
  The general consensus is that normal GA tracking alone does not meet the standards to trigger either the EU or the stricter Dutch cookie notification requirements since they are using first-party cookies not tied to PII and don't follow you across sites Do you have a good reference for this? Especially the "don't follow you across sites" seems weird as Google will end up collecting hits from the same IP/browser/etc combo across sites, which trivially allows following.
  - amichal 9y ago
    I don't know what firefox addon pages does (and i see they have a special arrangement) and am not taking sides but for IP at least there is an option partially scrub it before it gets to disk at Google. https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en Edit: what do we think?
  - amichal 9y ago
    Found a source for this opinion. Here [1] are instructions from the Dutch Government's "Personal Data Authority" on setting up GA in compliance with their laws in a way that does (did?) not require an explicit notice. See [2] for an explanation in english [1] https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/handleiding_privacyvriendelijk_instellen_google_analytics_1.pdf https://autoriteitpersoonsgegevens.nl/sites/default/files/at... [2] https://www.iabeurope.eu/eucookielaws/nl/ https://www.iabeurope.eu/eucookielaws/nl/ TLDR: If you use the following code. You are fine to use GA without a notice under Dutch law. ga('set', 'forceSSL', true); ga('set', 'anonymizeIp', true);
    - gcp 9y ago
      Thank you! This is really useful.
      - kuschku 9y ago
        Be aware, this changes in 316 days, when the EU GDPR comes into force, and makes even for those cases opt-in required.
lucideer 9y ago
I'm not sure what the "Mozilla Legal" process is, but this thread[0] from 2012 seems to be a recurring source of authority on decision-making around this, from my reading of Bugzilla. This is what tofumatt was referring to when closing this Github thread. [0] https://groups.google.com/forum/#!msg/mozilla.governance/9IQvIubDOXU/0tWVVlrUJOQJ https://groups.google.com/forum/#!msg/mozilla.governance/9IQ...

TekMol 9y ago

The "Get Add-ons" view in Firefox is an iframe Please don't hide behind technical details. If click something in the browser and it causes Google to be notified, then you have send data about me to Google. Without my consent. privacy policy is linked from the Get Add-ons view Nobody reads those and you know it. The reason people use Firefox is to not get tracked by Google. Honestly, you hugely fucked up with this one. You lost a massive amount of trust with me that took years to grow.

stinkytaco 9y ago
> Nobody reads those and you know it. The reason people use Firefox is to not get tracked by Google. If you care about privacy, blind trust is never something you should have. This has all the trappings of a mistake to me. A group of developers responsible for developing one area (the add-ons page), was not considering the impact it might have on another (the browser developers). Perhaps they should find a different solution, but it rings hollow to argue that a privacy conscious user shouldn't be expected to have read the privacy policy.
- kuschku 9y ago
  Someone submitted a PR to Mozilla to fix this, and the Mozilla devs closed it, arguing that Google Analytics does not count as tracking. See: https://github.com/mozilla/addons-frontend/pull/2787#issuecomment-314872289 https://github.com/mozilla/addons-frontend/pull/2787#issueco... The TOR devs are fixing this part in their browser, and their comment was: > Disallow `about:addons` unless the extensions directory is volatile, because regardless of what Mozilla PR says about respecting privacy, loading Google Analytics in a page that gets loaded as an IFRAME as part of an `about:` internal page, is anything but.
  - stinkytaco 9y ago
    Check that issue again. Before you posted this they agreed and pushed the issue to the add-ons team. Do not track should turn off Analytics. But that's not my point. As I said, they could well be wrong, but it's over the top to argue that it's Mozilla's fault for disclosing this in the privacy policy (which apparently no one reads). If you are so privacy conscious that this bothers you that much, the privacy policy should be required reading.

proactivesvcs 9y ago

May I suggest that Mozilla stops walking a "very thin line" between telemetry and user privacy and instead walks beside a very thick line, on the side of user privacy. This incident has proven how easy it is to step off a very thin line into territory that your users are disgusted by. Choose to walk the thick line and even if you stumble, you will not fall.