4 ms·

Sorry for the delay, got rate limited. The Mozilla Corporation sharing user metadata with the Mozilla Foundation to assist with internal decision making may te

Sorry for the delay, got rate limited. The Mozilla Corporation sharing user metadata with the Mozilla Foundation to assist with internal decision making may technically meet California's definition of "sale of data" despite constituting absolutely nothing even vaguely resembling what laypeople would consider a "sale of data". Note that the CCPA's "third party" clause is part of an "OR" set, alongside "another business". Mozilla Foundation and Mozilla Corporation are respectively "another business" relative to each one's self, despite not being unrelated third parties. The problem is not that Mozilla is actually selling user data (they're not in the sense that any layperson would understand "selling data" to mean), the problem is the way the California law is worded. As usual, tech-illiterate politicians aren't even competent enough to write laws with the nuance and understanding required to not botch the entirely good and justified intention without pointing a loaded legal gun at the heads of the genuinely innocent. Think along the lines of the CFAA's legal risks to good-faith security researchers¹, or how the DMCA would technically criminalize discussion of how to decode Pig Latin if that was used as a copyrighted media protection technique. ¹ At least up until the Biden administration instructed the DoJ to be more sane and reasonable about this: https://www.justice.gov/archives/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/archives/opa/pr/department-justice-a...

mimasama 2y ago
So I've read the CCPA again, and I've realized that Mozilla may have made an error in quoting the relevant part of the law in their blog. This part they quoted: > As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.” Is actually from a draft. The final version of the CCPA removed the "another business" part which was a drafting error as covered by this article from the IAPP: https://iapp.org/news/a/ccpa-cpras-hidden-third-party-business-classification/#:~:text=Yes%2C%20the%20definition%20of%20'sale'%20has%20a%20drafting%20error https://iapp.org/news/a/ccpa-cpras-hidden-third-party-busine... I will cut Mozilla some slack here because they probably have taken the supposed final text of the CCPA from Wikipedia's article of it: https://en.wikipedia.org/w/index.php?title=California_Consumer_Privacy_Act&oldid=1277812986 https://en.wikipedia.org/w/index.php?title=California_Consum... (and the website in the infobox still links to when it was an Assembly Bill at https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...) This is the true final definition of "sale" in California's privacy law: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.#:~:text=%E2%80%9Csale https://leginfo.legislature.ca.gov/faces/codes_displaySectio... Anyway even then I'm not sure if the Foundation would've been considered "another business", since "business" is defined first as any "legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners", which MoFo clearly doesn't do. There's the second definition might've covered the Foundation (since they control the Corporation which is covered by the first definition), but AFAIK the Corp doesn't share any consumer personal info back into the Foundation (if it does that would be concerning)
- blacklite 2y ago
  > I will cut Mozilla some slack here because they probably have taken the supposed final text of the CCPA from Wikipedia You don't think Mozilla ought to have a firm legal opinion on this that doesn't involve just going to Wikipedia and going "yeah that's good"?
  - mimasama 2y ago
    The blog was written by product management, and most likely legal just generally told them that they got their justification from the CCPA's definition of sale, and the PR/marketing just searched for it and gave it to the blog post's author. Since Wikipedia is usually the first result in a search engine (and even has its own infobox), that's probably what they went with.
- anonym29 2y ago
  I was sitting here thinking everyone else was wrong under the assunption that almost nobody here actually tried to read and interpret that wording in the least generous way possible (i.e. how lawyers intetpret everything), but I guess the joke's on Mozilla and I for reading the wrong version. Your attention to detail here is exceptional and commendable. I used to feel that Mozilla's decision here was defensible and misunderstood, but it's now looking more like Mozilla and I are guilty of misunderstanding, after reviewing your claims here. Thank you for having the patience to explain in such detail! Posts like yours here are part of the magic that elevates HN discussions over so many other forums on the web these days :)

mimasama 2y ago

So I've read the CCPA again, and I've realized that Mozilla may have made an error in quoting the relevant part of the law in their blog. This part they quoted: > As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.” Is actually from a draft. The final version of the CCPA removed the "another business" part which was a drafting error as covered by this article from the IAPP: https://iapp.org/news/a/ccpa-cpras-hidden-third-party-business-classification/#:~:text=Yes%2C%20the%20definition%20of%20'sale'%20has%20a%20drafting%20error https://iapp.org/news/a/ccpa-cpras-hidden-third-party-busine... I will cut Mozilla some slack here because they probably have taken the supposed final text of the CCPA from Wikipedia's article of it: https://en.wikipedia.org/w/index.php?title=California_Consumer_Privacy_Act&oldid=1277812986 https://en.wikipedia.org/w/index.php?title=California_Consum... (and the website in the infobox still links to when it was an Assembly Bill at https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...) This is the true final definition of "sale" in California's privacy law: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.#:~:text=%E2%80%9Csale https://leginfo.legislature.ca.gov/faces/codes_displaySectio... Anyway even then I'm not sure if the Foundation would've been considered "another business", since "business" is defined first as any "legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners", which MoFo clearly doesn't do. There's the second definition might've covered the Foundation (since they control the Corporation which is covered by the first definition), but AFAIK the Corp doesn't share any consumer personal info back into the Foundation (if it does that would be concerning)

blacklite 2y ago
> I will cut Mozilla some slack here because they probably have taken the supposed final text of the CCPA from Wikipedia You don't think Mozilla ought to have a firm legal opinion on this that doesn't involve just going to Wikipedia and going "yeah that's good"?
- mimasama 2y ago
  The blog was written by product management, and most likely legal just generally told them that they got their justification from the CCPA's definition of sale, and the PR/marketing just searched for it and gave it to the blog post's author. Since Wikipedia is usually the first result in a search engine (and even has its own infobox), that's probably what they went with.
anonym29 2y ago
I was sitting here thinking everyone else was wrong under the assunption that almost nobody here actually tried to read and interpret that wording in the least generous way possible (i.e. how lawyers intetpret everything), but I guess the joke's on Mozilla and I for reading the wrong version. Your attention to detail here is exceptional and commendable. I used to feel that Mozilla's decision here was defensible and misunderstood, but it's now looking more like Mozilla and I are guilty of misunderstanding, after reviewing your claims here. Thank you for having the patience to explain in such detail! Posts like yours here are part of the magic that elevates HN discussions over so many other forums on the web these days :)