4 ms·

> Firefox didn't make stupid policy changes. Firefox made policy changes they were legally required to in order to comply with a stupidly-worded California law.

> Firefox didn't make stupid policy changes. Firefox made policy changes they were legally required to in order to comply with a stupidly-worded California law. They had other options, including not collecting and selling user data. The California law is working as intended.

anonym29 2y ago
They're not selling user data in any sense that any ordinary, reasonable person would understand, only in California's excessively broad definition that may technically cover a litany of entirely noncommercial uses, like using opt-in customer metadata to improve their own free product, without distributing it to any third party at all. Businesses like to avoid risk where possible, and Mozilla's lawyers pushed this wording to ensure compliance with the riskiest possible interpretation of California's ambiguous and poorly-worded law.
- wtallis 2y ago
  > using opt-in customer metadata to improve their own free product, without distributing it to any third party at all. Explain how that qualifies under California's law. The requirement that data be shared to another business or third party seems pretty explicit.
  - anonym29 2y ago
    Sorry for the delay, got rate limited. The Mozilla Corporation sharing user metadata with the Mozilla Foundation to assist with internal decision making may technically meet California's definition of "sale of data" despite constituting absolutely nothing even vaguely resembling what laypeople would consider a "sale of data". Note that the CCPA's "third party" clause is part of an "OR" set, alongside "another business". Mozilla Foundation and Mozilla Corporation are respectively "another business" relative to each one's self, despite not being unrelated third parties. The problem is not that Mozilla is actually selling user data (they're not in the sense that any layperson would understand "selling data" to mean), the problem is the way the California law is worded. As usual, tech-illiterate politicians aren't even competent enough to write laws with the nuance and understanding required to not botch the entirely good and justified intention without pointing a loaded legal gun at the heads of the genuinely innocent. Think along the lines of the CFAA's legal risks to good-faith security researchers¹, or how the DMCA would technically criminalize discussion of how to decode Pig Latin if that was used as a copyrighted media protection technique. ¹ At least up until the Biden administration instructed the DoJ to be more sane and reasonable about this: https://www.justice.gov/archives/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/archives/opa/pr/department-justice-a...
    - rstuart4133 2y ago
      @anonym29: a heads up. It appears you are trying to explain why CCPA's does not meet the laypersons definition of "selling data". After reading your explanation I'm none the wiser. Given no one has replied, I suspect that's true for most people. They've just scratched their head and moved on. I was about to do that too, when it dawned you probably have no idea people don't understand what you are saying. Maybe an example would help. Its needs top be something a layman would not consider to be "selling data" but the CCPA defines that way.
    - mimasama 2y ago
      For people reading this thread, read my reply to pretty much the same comment but in another thread: https://news.ycombinator.com/item?id=43276624 https://news.ycombinator.com/item?id=43276624 TLDR: The "OR" was a drafting error that Mozilla erroneously quoted. The final text of the CCPA removed the "another business" part.
- dns_snek 2y ago
  Claiming that users just don't understand what selling their data means is incredibly patronizing. Everyone colloquially understands that "selling user data" isn't limited to just selling ZIP archives of our browsing history, but also includes e.g. targeted advertising by the likes of Google, which is precisely why we sought alternatives that explicitly promised not to sell our data.
  - anonym29 2y ago
    I'm not making the claim that users don't understand what "selling their data" means, I'm making the claim that Mozilla is not doing anything that any reasonable person other than a lawyer interpreting the CCPA in the most unreasonable way possible would consider what Mozilla is doing to be "selling of data". It's an internal transfer between the Mozilla Foundation and the Mozilla Corporation that doesn't even involve money. No payments. No third parties whatsoever. In the CCPA's poor and ambiguous wording, this does technically constitute "sale of data", as the CCPA defines it. Please read my other newer posts in this thread.

anonym29 2y ago

They're not selling user data in any sense that any ordinary, reasonable person would understand, only in California's excessively broad definition that may technically cover a litany of entirely noncommercial uses, like using opt-in customer metadata to improve their own free product, without distributing it to any third party at all. Businesses like to avoid risk where possible, and Mozilla's lawyers pushed this wording to ensure compliance with the riskiest possible interpretation of California's ambiguous and poorly-worded law.

wtallis 2y ago
> using opt-in customer metadata to improve their own free product, without distributing it to any third party at all. Explain how that qualifies under California's law. The requirement that data be shared to another business or third party seems pretty explicit.
- anonym29 2y ago
  Sorry for the delay, got rate limited. The Mozilla Corporation sharing user metadata with the Mozilla Foundation to assist with internal decision making may technically meet California's definition of "sale of data" despite constituting absolutely nothing even vaguely resembling what laypeople would consider a "sale of data". Note that the CCPA's "third party" clause is part of an "OR" set, alongside "another business". Mozilla Foundation and Mozilla Corporation are respectively "another business" relative to each one's self, despite not being unrelated third parties. The problem is not that Mozilla is actually selling user data (they're not in the sense that any layperson would understand "selling data" to mean), the problem is the way the California law is worded. As usual, tech-illiterate politicians aren't even competent enough to write laws with the nuance and understanding required to not botch the entirely good and justified intention without pointing a loaded legal gun at the heads of the genuinely innocent. Think along the lines of the CFAA's legal risks to good-faith security researchers¹, or how the DMCA would technically criminalize discussion of how to decode Pig Latin if that was used as a copyrighted media protection technique. ¹ At least up until the Biden administration instructed the DoJ to be more sane and reasonable about this: https://www.justice.gov/archives/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/archives/opa/pr/department-justice-a...
  - rstuart4133 2y ago
    @anonym29: a heads up. It appears you are trying to explain why CCPA's does not meet the laypersons definition of "selling data". After reading your explanation I'm none the wiser. Given no one has replied, I suspect that's true for most people. They've just scratched their head and moved on. I was about to do that too, when it dawned you probably have no idea people don't understand what you are saying. Maybe an example would help. Its needs top be something a layman would not consider to be "selling data" but the CCPA defines that way.
  - mimasama 2y ago
    For people reading this thread, read my reply to pretty much the same comment but in another thread: https://news.ycombinator.com/item?id=43276624 https://news.ycombinator.com/item?id=43276624 TLDR: The "OR" was a drafting error that Mozilla erroneously quoted. The final text of the CCPA removed the "another business" part.
dns_snek 2y ago
Claiming that users just don't understand what selling their data means is incredibly patronizing. Everyone colloquially understands that "selling user data" isn't limited to just selling ZIP archives of our browsing history, but also includes e.g. targeted advertising by the likes of Google, which is precisely why we sought alternatives that explicitly promised not to sell our data.
- anonym29 2y ago
  I'm not making the claim that users don't understand what "selling their data" means, I'm making the claim that Mozilla is not doing anything that any reasonable person other than a lawyer interpreting the CCPA in the most unreasonable way possible would consider what Mozilla is doing to be "selling of data". It's an internal transfer between the Mozilla Foundation and the Mozilla Corporation that doesn't even involve money. No payments. No third parties whatsoever. In the CCPA's poor and ambiguous wording, this does technically constitute "sale of data", as the CCPA defines it. Please read my other newer posts in this thread.