[simpss]

Just a few days ago, they updated their android application info and stated they're going to share location data with third parties for "Advertising or Marketing" purposes...[1]

They also removed a promise to "never sell your data" in their FAQ[2] 2 weeks ago.

[1] - https://news.ycombinator.com/item?id=43326230

[2] - https://github.com/mozilla/bedrock/commit/d459addab846d8144b...

[bad_user]

Sure, but my point is that Firefox has been funded by Google since 2006, and by having it as the default search engine, Firefox has been sending suggestion queries and searches to Google.

Of course, the nuance here is that this was part of a user action, i.e., the user probably wants to search, so they expect data to be sent to Google (although the address bar suggestions are a gray area IMO). However, what hasn't been expected, and the whole purpose of the GDPR, is that Google does store your search history for advertising purposes without user consent.

So, even if it was unavoidable, Firefox has already been selling user data to Google by simply making it the default search engine and getting paid to do it.

BTW, the GDPR is really strict, and I'll know that Firefox actually sells my data (in a way that I don't expect) when I'll see a GDPR interstitial about it for getting my consent. For instance, when you first open Microsoft's Edge in the EU, they inform users that they're going to share their data with the entire advertising industry.

[simpss]

As I understand, these "data safety" sections are what Google gives app owners to comply with "right to be informed". If they say "we're sharing location data with third parties for Advertising purposes" I'm believing it.

I agree that they should really be asking for consent as well, but they don't seem to be doing that. We've got no way to use legitimate location related functionality and deny advertising related usecases. Remember, consent must be specific and granular.

It'll be a while, until enforcement catches up. It's taken ~6 years for cookie banners to get a "reject" button and those are really easy to review and enforce.

It'll happen though, enforcement is just slow. GDPR is a fairly well written regulation, as far as corner cases and catching workarounds goes. So unless the laws change, enforcement will catch up eventually.