They're not selling user data in any sense that any ordinary, reasonable person would understand, only in California's excessively broad definition that may technically cover a litany of entirely noncommercial uses, like using opt-in customer metadata to improve their own free product, without distributing it to any third party at all.

Businesses like to avoid risk where possible, and Mozilla's lawyers pushed this wording to ensure compliance with the riskiest possible interpretation of California's ambiguous and poorly-worded law.

> using opt-in customer metadata to improve their own free product, without distributing it to any third party at all.

Explain how that qualifies under California's law. The requirement that data be shared to another business or third party seems pretty explicit.

Sorry for the delay, got rate limited.

The Mozilla Corporation sharing user metadata with the Mozilla Foundation to assist with internal decision making may technically meet California's definition of "sale of data" despite constituting absolutely nothing even vaguely resembling what laypeople would consider a "sale of data".

Note that the CCPA's "third party" clause is part of an "OR" set, alongside "another business". Mozilla Foundation and Mozilla Corporation are respectively "another business" relative to each one's self, despite not being unrelated third parties.

The problem is not that Mozilla is actually selling user data (they're not in the sense that any layperson would understand "selling data" to mean), the problem is the way the California law is worded.

As usual, tech-illiterate politicians aren't even competent enough to write laws with the nuance and understanding required to not botch the entirely good and justified intention without pointing a loaded legal gun at the heads of the genuinely innocent. Think along the lines of the CFAA's legal risks to good-faith security researchers¹, or how the DMCA would technically criminalize discussion of how to decode Pig Latin if that was used as a copyrighted media protection technique.

¹ At least up until the Biden administration instructed the DoJ to be more sane and reasonable about this: https://www.justice.gov/archives/opa/pr/department-justice-a...

@anonym29: a heads up.

It appears you are trying to explain why CCPA's does not meet the laypersons definition of "selling data". After reading your explanation I'm none the wiser. Given no one has replied, I suspect that's true for most people. They've just scratched their head and moved on.

I was about to do that too, when it dawned you probably have no idea people don't understand what you are saying. Maybe an example would help. Its needs top be something a layman would not consider to be "selling data" but the CCPA defines that way.

For people reading this thread, read my reply to pretty much the same comment but in another thread: https://news.ycombinator.com/item?id=43276624

TLDR: The "OR" was a drafting error that Mozilla erroneously quoted. The final text of the CCPA removed the "another business" part.

Claiming that users just don't understand what selling their data means is incredibly patronizing. Everyone colloquially understands that "selling user data" isn't limited to just selling ZIP archives of our browsing history, but also includes e.g. targeted advertising by the likes of Google, which is precisely why we sought alternatives that explicitly promised not to sell our data.

I'm not making the claim that users don't understand what "selling their data" means, I'm making the claim that Mozilla is not doing anything that any reasonable person other than a lawyer interpreting the CCPA in the most unreasonable way possible would consider what Mozilla is doing to be "selling of data". It's an internal transfer between the Mozilla Foundation and the Mozilla Corporation that doesn't even involve money. No payments. No third parties whatsoever. In the CCPA's poor and ambiguous wording, this does technically constitute "sale of data", as the CCPA defines it. Please read my other newer posts in this thread.