Security/Anti tracking policy
This document describes the online tracking practices that Mozilla believes, as a matter of policy, should be blocked by default by web browsers. These practices are potentially harmful to users and cannot be meaningfully understood or controlled by users.
We intend to implement technical protections in Firefox to block all tracking practices included in this policy. If we discover additional tracking techniques, we may expand this policy to include the new technique and may implement technical measures to block those techniques in Firefox.
Our current anti-tracking mitigations in Firefox rely on the Tracking Protection list to classify trackers. This list is curated by Disconnect in alignment with this policy.
Tracking is the collection of data regarding a particular user's activity across multiple websites or applications (i.e., first parties) that aren’t owned by the data collector, and the retention, use, or sharing of data derived from that activity with parties other than the first party on which it was collected.
A first party is a resource or a set of resources on the web operated by the same organization, which is both easily discoverable by the user and with which the user intends to interact. An intention to interact is characterized by a deliberate action, such as clicking a link, submitting a form, or reloading a page. Merely hovering over, muting, pausing, or closing a given piece of content does not constitute an intention to interact. Interactions with other parties are considered third-party, even if the user is transiently informed in context (for example, in the form of a redirect).
A third party is any party that does not fall within the definition of first party above.
Tracking We Will Block
1. Stateful cross-site tracking through Web APIs
Cookie-based cross-site tracking. Cookies, DOM storage, and other types of stateful identifiers are often used by third parties to associate browsing across multiple websites with the same user and to build profiles of those users, in violation of the user’s expectation.
For third parties engaged in this type of tracking, Firefox will block or remove access to stateful identifiers. Access to storage may be granted when a user has shown purposeful intent to interact with a third party during their visit to a specific first party. For example, if a user attempts to interact with a third-party login provider while visiting a specific first party, the third-party provider may receive storage access on that first party.
URL parameter-based cross-site tracking. When cookie-based tracking is not available, some third parties decorate URLs with user identifiers. When the browser requests those resources, either through a top-level navigation or a subresource request, those user identifiers are available to other websites or third parties. Any party actively setting, retrieving, or sharing an identifier or other personal data in a URL for the purpose of building a user profile is in violation of this policy. Firefox will blocklist parameters included in the URL for this purpose and remove them from cross-site top-level navigations.
User profile building is currently characterized by Firefox through the following client-observable traits:
- High-entropy parameters that may identify a user (assign a unique identifier to a user) or encode user data. Exceptions being:
- Parameters exclusively identifying specific elements or actions on the navigating page (per-click or per-element identifiers). These parameters must assign a different value to each click or element they are identifying.
- Identifiers necessary to complete a user-initiated task such as logging in or submitting a form.
- High-entropy parameters that are broadly included in all (or nearly all) outgoing navigations from a site, even if the parameters are not uniquely identifying a user.
Because any type of URL decoration can violate some users’ personal sense of privacy, we allow for optionally configuring Firefox to apply stricter rules for parameter removal and may remove more parameters on certain user actions such as sharing a URL.
Firefox may also apply stricter rules for parameter removal by default in the future, which will be reflected in this policy.
3. Tracking via unintended identification techniques
Unintended identification techniques use browser features that are not intended for device or user identification for the purposes of storing or generating a tracking identifier. Unlike tracking using standards-defined storage locations - such as cookies or the Web Storage API - these techniques are not under the control of the browser’s state management settings.Thus can not be easily cleared or reset by users. Examples include, but are not limited to:
- Browser fingerprinting. Fingerprinting is used to identify a user or user agent by the set of properties of the browser, the device, or the network, rather than by setting state on the device. For example, a party which infers the set of fonts a user has installed on their device and collects this information alongside other device information would be considered to participate in browser fingerprinting.
- Supercookies. This refers to a collection of techniques that involve storing tracking identifiers in areas of the browser that are not cleared when the standards-defined locations are cleared. This allows a tracker to re-establish a tracking identifier after a user or user agent clears storage. For example, a party which uses multiple domains to encode a tracking identifier in HTTPS Strict Transport Security flags would be considered to use supercookies.
While this type of tracking is not currently blocked in Firefox, we may apply additional restrictions to the third parties engaged in this type of tracking in the future.
If a party attempts to circumvent the technical solutions we’ve outlined in this policy, we may without notice add additional restrictions to that party to prevent the circumvention.
We will block the practices described above when the party using them is classified as a tracker. We previously offered a set of exceptions independent from tracker classification, but as of July 9, 2019 we will no longer grant new exceptions. We will stop honoring the current set of exceptions in a future version of Firefox.
Temporary Web Compatibility Interventions
If we discover breakage that we'd like to fix through Firefox code changes, we may temporarily disable a protection for the relevant domains while we work on the fixes. To prevent these from becoming permanent exceptions, a deadline must be provided by the engineer at the time of unblocking, with a maximum deadline of 18 months. We may alternatively unblock domains for up to 6 months when we are working in collaboration with the impacted site or party to fix website breakage. These interventions are tracked in Bug 1537702.
Questions about this policy should be directed to firstname.lastname@example.org.