7 ms·

Quoting from Mozilla's blog: > The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL de

Quoting from Mozilla's blog: > The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.” How is the CCPA stupidly-worded when that's what a layman would think "selling data" means? I do wholeheartedly agree with your sentiments about the WHATWG though, as someone who contributed to Pale Moon's development. That web browser cartel should be investigated by the US government for anti-competitive practices as they did with Google and Microsoft.

MattPalmer1086 2y ago
>How is the CCPA stupidly-worded when that's what a layman would think "selling data" means? Because it is the twisty logic that lawyers can apply which is relevant to mitigate legal risk, not what a layman would think. Where I work, our lawyers are convinced that running our code in the cloud to run our service counts as "distribution" under the terms of open source licenses. Because a cloud employee might accidentally look at it or something? Who knows. A lawyer sees legal risk in things you or I don't; they should know I guess!
anonym29 2y ago
Sorry for the delay, got rate limited. The Mozilla Corporation sharing user metadata with the Mozilla Foundation to assist with internal decision making may technically meet California's definition of "sale of data" despite constituting absolutely nothing even vaguely resembling what laypeople would consider a "sale of data". Note that the CCPA's "third party" clause is part of an "OR" set, alongside "another business". Mozilla Foundation and Mozilla Corporation are respectively "another business" relative to each one's self, despite not being unrelated third parties. The problem is not that Mozilla is actually selling user data (they're not in the sense that any layperson would understand "selling data" to mean), the problem is the way the California law is worded. As usual, tech-illiterate politicians aren't even competent enough to write laws with the nuance and understanding required to not botch the entirely good and justified intention without pointing a loaded legal gun at the heads of the genuinely innocent. Think along the lines of the CFAA's legal risks to good-faith security researchers¹, or how the DMCA would technically criminalize discussion of how to decode Pig Latin if that was used as a copyrighted media protection technique. ¹ At least up until the Biden administration instructed the DoJ to be more sane and reasonable about this: https://www.justice.gov/archives/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/archives/opa/pr/department-justice-a...
- mimasama 2y ago
  So I've read the CCPA again, and I've realized that Mozilla may have made an error in quoting the relevant part of the law in their blog. This part they quoted: > As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.” Is actually from a draft. The final version of the CCPA removed the "another business" part which was a drafting error as covered by this article from the IAPP: https://iapp.org/news/a/ccpa-cpras-hidden-third-party-business-classification/#:~:text=Yes%2C%20the%20definition%20of%20'sale'%20has%20a%20drafting%20error https://iapp.org/news/a/ccpa-cpras-hidden-third-party-busine... I will cut Mozilla some slack here because they probably have taken the supposed final text of the CCPA from Wikipedia's article of it: https://en.wikipedia.org/w/index.php?title=California_Consumer_Privacy_Act&oldid=1277812986 https://en.wikipedia.org/w/index.php?title=California_Consum... (and the website in the infobox still links to when it was an Assembly Bill at https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...) This is the true final definition of "sale" in California's privacy law: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.#:~:text=%E2%80%9Csale https://leginfo.legislature.ca.gov/faces/codes_displaySectio... Anyway even then I'm not sure if the Foundation would've been considered "another business", since "business" is defined first as any "legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners", which MoFo clearly doesn't do. There's the second definition might've covered the Foundation (since they control the Corporation which is covered by the first definition), but AFAIK the Corp doesn't share any consumer personal info back into the Foundation (if it does that would be concerning)
  - blacklite 2y ago
    > I will cut Mozilla some slack here because they probably have taken the supposed final text of the CCPA from Wikipedia You don't think Mozilla ought to have a firm legal opinion on this that doesn't involve just going to Wikipedia and going "yeah that's good"?

MattPalmer1086 2y ago

>How is the CCPA stupidly-worded when that's what a layman would think "selling data" means? Because it is the twisty logic that lawyers can apply which is relevant to mitigate legal risk, not what a layman would think. Where I work, our lawyers are convinced that running our code in the cloud to run our service counts as "distribution" under the terms of open source licenses. Because a cloud employee might accidentally look at it or something? Who knows. A lawyer sees legal risk in things you or I don't; they should know I guess!

anonym29 2y ago

Sorry for the delay, got rate limited. The Mozilla Corporation sharing user metadata with the Mozilla Foundation to assist with internal decision making may technically meet California's definition of "sale of data" despite constituting absolutely nothing even vaguely resembling what laypeople would consider a "sale of data". Note that the CCPA's "third party" clause is part of an "OR" set, alongside "another business". Mozilla Foundation and Mozilla Corporation are respectively "another business" relative to each one's self, despite not being unrelated third parties. The problem is not that Mozilla is actually selling user data (they're not in the sense that any layperson would understand "selling data" to mean), the problem is the way the California law is worded. As usual, tech-illiterate politicians aren't even competent enough to write laws with the nuance and understanding required to not botch the entirely good and justified intention without pointing a loaded legal gun at the heads of the genuinely innocent. Think along the lines of the CFAA's legal risks to good-faith security researchers¹, or how the DMCA would technically criminalize discussion of how to decode Pig Latin if that was used as a copyrighted media protection technique. ¹ At least up until the Biden administration instructed the DoJ to be more sane and reasonable about this: https://www.justice.gov/archives/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/archives/opa/pr/department-justice-a...

mimasama 2y ago
So I've read the CCPA again, and I've realized that Mozilla may have made an error in quoting the relevant part of the law in their blog. This part they quoted: > As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.” Is actually from a draft. The final version of the CCPA removed the "another business" part which was a drafting error as covered by this article from the IAPP: https://iapp.org/news/a/ccpa-cpras-hidden-third-party-business-classification/#:~:text=Yes%2C%20the%20definition%20of%20'sale'%20has%20a%20drafting%20error https://iapp.org/news/a/ccpa-cpras-hidden-third-party-busine... I will cut Mozilla some slack here because they probably have taken the supposed final text of the CCPA from Wikipedia's article of it: https://en.wikipedia.org/w/index.php?title=California_Consumer_Privacy_Act&oldid=1277812986 https://en.wikipedia.org/w/index.php?title=California_Consum... (and the website in the infobox still links to when it was an Assembly Bill at https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...) This is the true final definition of "sale" in California's privacy law: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.#:~:text=%E2%80%9Csale https://leginfo.legislature.ca.gov/faces/codes_displaySectio... Anyway even then I'm not sure if the Foundation would've been considered "another business", since "business" is defined first as any "legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners", which MoFo clearly doesn't do. There's the second definition might've covered the Foundation (since they control the Corporation which is covered by the first definition), but AFAIK the Corp doesn't share any consumer personal info back into the Foundation (if it does that would be concerning)
- blacklite 2y ago
  > I will cut Mozilla some slack here because they probably have taken the supposed final text of the CCPA from Wikipedia You don't think Mozilla ought to have a firm legal opinion on this that doesn't involve just going to Wikipedia and going "yeah that's good"?