Firefox’s new data collection feature sparks user backlash: here’s how to disable it

The browser that promises “no shady privacy notices or advertiser backdoors” on its storefront has suddenly added an experimental feature to beam user interactions to advertisers and enables it by default. Many are not happy.

Firefox released version 128, and with it, the browser is shipping a new “Privacy-preserving attribution” (PPA) feature, which has sparked controversy. By default, Firefox collects data for advertisers. Users have to manually deactivate the feature if they don’t want it.

The PPA feature enables advertisers to measure conversions without using third-party cookies. Cookies are another technology used for tracking that users often choose to restrict to protect their privacy.

“This helps sites understand how their ads perform without collecting data about you,” the PPA option explanation reads in Firefox settings.

Some accuse Mozilla of deliberately deceiving users by sneaking in another tool for advertisers to track user interactions online.

Jonah Aragon, the founder of the Privacy Guides blog, expressed his disappointment with Mozilla, calling PPA another tool in the arsenal of advertiser tracking features. The technology comes from a recently acquired AdTech company Anonym and traditional content-blocking extensions are not effective against it.

“Simply adding ‘privacy’ to the name of your feature does not make it private,” Aragon said in a blog post. He believes that Mozilla knows that its users wouldn’t welcome such a feature, otherwise, it would be explained publicly, and developers would have been given some time to explore it.

The discussions were heated on Mastodon, where one user said that it would be better for Mozilla to be “holding everyone to ransom and saying they will post everyone’s bookmarks and browser history in public unless we all paid $50 to fund Firefox development”

Bas Schouten, Mozilla's Performance Tech Lead, responded that there are no uncompromised browsers, and the PPA “actually will allow advertisers to get specific click-through information without tracking users,” as only aggregated reports are generated.

“Opt-in is only meaningful if users can make an informed decision. I think explaining a system like PPA would be a difficult task. And most users complain a lot about these types of interruption,” Schouten argued on Mastodon.

Other developers shared comments that cookieless tracking offers little privacy, and the data can easily be deanonymized using various techniques and tied to visitor-unique advertising IDs. Moreover, the feature is not limited to advertising and can be used on any element the website loads. However, users of other browsers have been exposed to similar features for a while now.

How does the PPA work?

The idea behind PPA is “to help sites understand how their ads perform without collecting data about individual people,” according to Mozilla's support page. The company hopes that PPA is a good advertising effectiveness measurement solution alternative to worse practices.

The browser itself would collect and send the data as follows:

• Websites that show you ads can ask Firefox to remember them and store an “impression,” containing some information about the ad and website
• After visiting the landing page and conversion, the website can ask Firefox to generate a report, specifying what ads it is interested in.
• Firefox creates a report but does not hand it to the website. Instead, the encrypted report is submitted to an “aggregation service,” where results are combined with many similar reports by the aggregation service.

“The destination website periodically receives a summary of the reports. The summary includes noise that provides differential privacy,” Mozilla explains.

The company says that browsing activities are not sent to anyone, including Mozilla. Advertisers only receive the aggregate information.

However, Aragon and other critics counter that only Mozilla's words protect the user data and that the system could be modified in the future.

“Firefox users are fully capable of understanding basic concepts like tracking, and can make an informed decision about whether they want their browser to track them. Mozilla refuses to acknowledge this because it's in their best (financial) interest to get as many people as possible to use this feature,” Aragon noted.

He suggested that advertisers use unique links for advertisements and track conversions by calculating the visits from each link.

Cybernews has reached out to Mozilla and will update the article with their response.

How to disable the tracking feature?

Firefox allows opt-out in the settings, and says websites “will not know if you choose to opt-out in this way”:

• Go to Settings (In the Menu bar click Firefox, select Preferences or Settings)
• In the Privacy & Security panel, find the Website Advertising Preferences section.
• Uncheck the box labeled Allow websites to perform privacy-preserving ad measurement.