Data protection complaint: Noyb takes action against Firefox' tracking function

The civil society organization Noyb, founded by Max Schrems, has filed a complaint against Mozilla with the Austrian data protection authority. The reason is a new function in Firefox for the supposedly privacy-friendly display of advertising. The activists believe that the procedure known as "Privacy-Preserving Attribution" (PPA) is a violation of the General Data Protection Regulation (GDPR). Contrary to its "trust-inspiring name", Firefox can use the technology to track user behavior, complains Noyb. In essence, the browser is now responsible for tracking – rather than individual website operators. This may be "an improvement on the even more invasive cookie tracking". However, users were never asked whether they wanted to activate PPA.

Mozilla had activated the function by default when installing the software update to version 128. This is particularly worrying as the browser manufacturer "generally has a reputation for being a privacy-friendly alternative" to Google Chrome in particular. Despite this, there is not even a reference to the new function in Mozilla's privacy policy. The only way for users to deactivate it is to find and deactivate it in a submenu of the browser settings – under advertising measurement. "Irritatingly", a Mozilla developer justified this step by saying that users "could no longer make an informed decision" about personalized advertising anyway.

Good intentions, poor implementation

At the heart of PPA is an aggregation server that stands between advertising providers and user data. It is designed to anonymize the information from individual web browsers. Only then does the intermediate instance make the aggregated data available to the participating advertisers. "Instead of placing conventional cookies, websites have to ask Firefox to store information about users' advertising interactions", says Noyb, explaining the idea. "They then receive the aggregated data of several people." Google has developed a similar approach with the no less controversial Privacy Sandbox, which is currently no longer being pursued. Ultimately, according to the civil rights campaigners, PPA does not replace conventional cookies. Rather, it represents an additional option for online portals to place and measure targeted advertising.

"Mozilla may have had good intentions", says Felix Mikolasch, data protection lawyer at Noyb, assessing the case. However, it is unlikely that PPA will sweep other tracking tools off the market. It is therefore just a new, additional tool for collecting data and creating profiles. For the expert, it is a "tragedy" that Mozilla even considers Firefox users to be too stupid "to decide between yes and no". They should be able to make a choice. The function should have been deactivated by default. According to Noyb, the data protection authority called upon should, among other things, ensure that the US company deletes all unlawfully processed user data.

Mozilla has so far tried to pass the buck to the advertising industry, which has turned the internet into a surveillance network. Firefox CTO Bobby Holley had said that the PPA function was a pragmatic solution under these circumstances with the aim of safeguarding user privacy.

(mki)