New Snippet Feature and Update to Privacy Policy

[Winston Bowden]

Hello,

I’d like to make you aware of a new feature the engagement team is working on and request feedback on proposed updates to the privacy policy.

The feature will allow us to provide users with a snippet (a message on their Firefox home page) based on the country they’re in. We’ve worked with several Mozilla departments to develop this feature. Privacy, legal, product, web dev, security and IT have provided valuable feedback to ensure this was implemented in a way that maximizes the user value.

What is the snippet?
If you haven’t changed your start page on Firefox desktop, you’ll see an icon and a few lines of copy underneath the search box. We call these messages snippets. Snippets are a feature of the Firefox start page that provide users with timely and relevant information on how to get more out of their Firefox experience.

How is the snippet changing?
Currently there isn’t a reliable way to communicate with ours users based on their country. For instance, if we need to rally around an important cause in Brazil, we don’t have the ability to reach out to those users. The current system can send a message based on build (channel + language), but builds reach users around the world rather than a specific country.

Here are some specific use cases where this service will be used:

Community:
We’ll now be able to broaden our community base in countries by announcing regional Mozilla events or opportunities to get involved with the project. If we’re holding a special event in Brazil, we’ll be able to alert that user base quickly and easily.

Policy:
If and when Mozilla needs to rally against legislation like SOPA in countries outside of the U.S., we’ll have the ability to reach the users that will be impacted and exclude those who aren’t.

Firefox OS:
With the launch of Firefox OS and Marketplace, there are many opportunities to provide users with content that is relevant to their region. For example, as phones become available in certain countries, we’ll have the ability to inform those users.

What’s the technical change?
Currently, snippets are delivered based on the build (channel + language) the user has downloaded. This can be problematic if we’re trying to talk to users in a specific region or country. For example, if you’re on the en-us build in Japan, you’re going to see the EN snippets. We’re limited in terms of delivering relevant content and information to our user base.

How it will work:

- Mozilla will use a geo location service that is internally hosted. We purchased a license to a database and serve it from Mozilla servers using a custom service we’re developing. The database is specifically designed to return the country of origin for a given IP address.

- Once a month, when the user opens the about:home page, Firefox desktop will send the browser’s IP address to this internal service, and the service will return the name of the country the user is located in. The browser will store the country name in localStorage. Note that it is the actual country name that is being stored – NOT the IP address. The IP address is not stored after country is established on either the client or server.

This is a privacy friendly implementation:

- Mozilla does not store the country location of a user to provide this feature
- IP addresses are collected as a part of standard web connections. The country information is maintained in HTML5 localStorage on the user’s Firefox. The result of a lookup – a particular IP and country – are not stored in the same place, ever.
- We will be updating our privacy policy. Proposed changes are included below for your comments.
- If users change their default homepage, the snippet service, including this function, will be disabled.

We’ll be updating the section dealing with snippets to:

Our proposal for updating the privacy policy:

--------------------

Firefox's default home page (<about:home>) loads snippets of info that we think will be useful to you. Snippets are designed to provide you with timely and relevant information on how to get more out of your Firefox experience. You can see them right below the search bar.

Once per day, Firefox gets new snippets from Mozilla. Whenever you see a snippet, that snippet makes a request to Mozilla, so that we can count how often snippets are viewed. This request to Mozilla sends the name of the snippet and is securely transmitted over HTTPS. Aside from this and standard log data collected as a part of any web request, snippets in Firefox does not send other information to Mozilla.

To help display relevant snippets, your Firefox browser sends Mozilla a monthly request to resolve your location at a country level using your IP address. We then send that country level information back to your Firefox browser, where it's stored in HTML local storage. Your Firefox browser (not our web servers) will then pick snippets to show you based on the locally stored country information.

Aside from providing you with the snippets service, we use the information from these requests to estimate what fraction of Firefox users click on each snippet, and we break down this info into general categories like Firefox version and geographic area. We will not use any of the information in this request to attempt to identify you or your activity anywhere else online, and we aggregate the info we receive into these general categories as soon as is practical.

You can turn off Snippets by following the instructions here: https://support.mozilla.org/en-US/kb/How%20to%20set%20the%20home%20page.

--------------------

Thanks for your feedback-
Winston Bowden

[Fjoerfoks]

Hi Winston,

Although I like the concept of geolocating for services, on the other hand,
if this is the only thing you're looking at,
you're a sort of disrespecting the usersettings for their preferred
language.
Right now there are several countries where people speak different
languages apart from the main language.
E.g., right now 2/3 of the Firefox users in The Netherlands are using the
Dutch version, which means that
1/3 of the people will receive Dutch snippets instead of their preferred
language like English or Polish.
(based on the weekly Metrics). Furthermore I know there are lots of users
with a Dutch Firefox using it
in other countries than the Netherlands.
Not the worst of this choice, this way you're also bypassing the smaller
languages like Frisian and Gaelic
for which we have created snippets in the past together with Pascal
Chevrel. He will be able to tell you
all about the challenges he faced solving this.

My 2 cents.
Wim

2013/3/28 Winston Bowden <winston...@gmail.com>

> _______________________________________________
> governance mailing list
> gover...@lists.mozilla.org
> https://lists.mozilla.org/listinfo/governance
>

[flod]

> Although I like the concept of geolocating for services, on the other hand,
> if this is the only thing you're looking at,
> you're a sort of disrespecting the usersettings for their preferred
> language.
>

I believe these geolocalized snippets are planned for other purposes and
won't replace the existing localized system (please correct me if I'm
wrong):

- If I'm organizing an event in Milan, I want people who live in Italy,
not people using Firefox in Italian.
- If I want to talk about Firefox OS phones and they're sold in Brazil,
I don't want to target all people speaking Brazilian, just those who live
in a country were they can actually buy the phone.

Francesco

[Winston Bowden]

That's a great point and I should have clarified in the post. Language settings are absolutely honored first. Here's how it would operate:

about:home will consider both your profile's language setting and your physical country when delivering snippets. So if your language is English but the geolocation ping happens while you're in Malaysia, you'll only receive snippets that are both targeted to Malaysia AND in English. This means you probably won't see Malaysian-targeted snippets since they'd most likely be translated, but it also means you won't see snippets targeted to the UK for a month.

[Winston Bowden]

That's a great point and I should have clarified in the post. Language settings are absolutely honored first. Here's how it would operate:

about:home will consider both your profile's language setting and your physical country when delivering snippets. So if your language is English but the geolocation ping happens while you're in Malaysia, you'll only receive snippets that are both targeted to Malaysia AND in English. This means you probably won't see Malaysian-targeted snippets since they'd most likely be translated, but it also means you won't see snippets targeted to the UK for a month.

On Thursday, March 28, 2013 1:16:09 AM UTC-7, Fjoerfoks wrote:

[Axel Hecht]

On 27.03.13 17:38, Winston Bowden wrote:
> Hello,
>
> I�d like to make you aware of a new feature the engagement team is working on and request feedback on proposed updates to the privacy policy.
>
> The feature will allow us to provide users with a snippet (a message on their Firefox home page) based on the country they�re in. We�ve worked with several Mozilla departments to develop this feature. Privacy, legal, product, web dev, security and IT have provided valuable feedback to ensure this was implemented in a way that maximizes the user value.
>
> What is the snippet?
> If you haven�t changed your start page on Firefox desktop, you�ll see an icon and a few lines of copy underneath the search box. We call these messages snippets. Snippets are a feature of the Firefox start page that provide users with timely and relevant information on how to get more out of their Firefox experience.

>
> How is the snippet changing?

> Currently there isn�t a reliable way to communicate with ours users based on their country. For instance, if we need to rally around an important cause in Brazil, we don�t have the ability to reach out to those users. The current system can send a message based on build (channel + language), but builds reach users around the world rather than a specific country.

>
> Here are some specific use cases where this service will be used:
>
> Community:

> We�ll now be able to broaden our community base in countries by announcing regional Mozilla events or opportunities to get involved with the project. If we�re holding a special event in Brazil, we�ll be able to alert that user base quickly and easily.
>
> Policy:
> If and when Mozilla needs to rally against legislation like SOPA in countries outside of the U.S., we�ll have the ability to reach the users that will be impacted and exclude those who aren�t.
>
> Firefox OS:
> With the launch of Firefox OS and Marketplace, there are many opportunities to provide users with content that is relevant to their region. For example, as phones become available in certain countries, we�ll have the ability to inform those users.
>
> What�s the technical change?
> Currently, snippets are delivered based on the build (channel + language) the user has downloaded. This can be problematic if we�re trying to talk to users in a specific region or country. For example, if you�re on the en-us build in Japan, you�re going to see the EN snippets. We�re limited in terms of delivering relevant content and information to our user base.
>
> How it will work:
>
> - Mozilla will use a geo location service that is internally hosted. We purchased a license to a database and serve it from Mozilla servers using a custom service we�re developing. The database is specifically designed to return the country of origin for a given IP address.
>
> - Once a month, when the user opens the about:home page, Firefox desktop will send the browser�s IP address to this internal service, and the service will return the name of the country the user is located in. The browser will store the country name in localStorage. Note that it is the actual country name that is being stored � NOT the IP address. The IP address is not stored after country is established on either the client or server.

>
> This is a privacy friendly implementation:
>
> - Mozilla does not store the country location of a user to provide this feature

> - IP addresses are collected as a part of standard web connections. The country information is maintained in HTML5 localStorage on the user�s Firefox. The result of a lookup � a particular IP and country � are not stored in the same place, ever.

> - We will be updating our privacy policy. Proposed changes are included below for your comments.
> - If users change their default homepage, the snippet service, including this function, will be disabled.
>

> We�ll be updating the section dealing with snippets to:

>
> Our proposal for updating the privacy policy:
>
> --------------------
>
> Firefox's default home page (<about:home>) loads snippets of info that we think will be useful to you. Snippets are designed to provide you with timely and relevant information on how to get more out of your Firefox experience. You can see them right below the search bar.
>
> Once per day, Firefox gets new snippets from Mozilla. Whenever you see a snippet, that snippet makes a request to Mozilla, so that we can count how often snippets are viewed. This request to Mozilla sends the name of the snippet and is securely transmitted over HTTPS. Aside from this and standard log data collected as a part of any web request, snippets in Firefox does not send other information to Mozilla.
>
> To help display relevant snippets, your Firefox browser sends Mozilla a monthly request to resolve your location at a country level using your IP address. We then send that country level information back to your Firefox browser, where it's stored in HTML local storage. Your Firefox browser (not our web servers) will then pick snippets to show you based on the locally stored country information.
>
> Aside from providing you with the snippets service, we use the information from these requests to estimate what fraction of Firefox users click on each snippet, and we break down this info into general categories like Firefox version and geographic area. We will not use any of the information in this request to attempt to identify you or your activity anywhere else online, and we aggregate the info we receive into these general categories as soon as is practical.
>
> You can turn off Snippets by following the instructions here: https://support.mozilla.org/en-US/kb/How%20to%20set%20the%20home%20page.
>
> --------------------
>
> Thanks for your feedback-
> Winston Bowden

I have some implementation questions, too, where's the best place to
discuss those? m.d.a.firefox or firefox-dev, or some other forum?

On to the actual privacy policy: I think there's a host of jargon and
technical detail in that part. I'm afraid that's not all that
human-readable, in particular for non-technical audience who's not
native English speaker.

Much of that is already in
http://www.mozilla.org/en-US/legal/privacy/firefox.html, but I'd prefer
to make things better. If we could reword it to just not say "snippet"
at all, for example.

Example of too much detail: does is really matter if the region is
stored in HTML local storage instead of just stored locally?

Axel

[Gavin Sharp]

On Thu, Mar 28, 2013 at 3:39 PM, Axel Hecht <l1...@mozilla.com> wrote:
> I have some implementation questions, too, where's the best place to discuss
> those? m.d.a.firefox or firefox-dev, or some other forum?

firefox-dev.

(But in case it answers your question: I had a quick IRC discussion
with mkelly - he pointed me to
https://github.com/mozilla/snippets/blob/master/standard-js/snippet.html#L94
, where you can read the code. In short, the implementation lives
entirely in the snippet JS that gets run on about:home using the
existing snippets mechanism - no changes to Firefox. The reason we're
doing the "retrieve the location once per month" thing is to allow
better caching of snippet responses. Doing a location lookup on each
request would not be feasible.)

Gavin

[Jishnu]

On Thursday, March 28, 2013 12:39:18 PM UTC-7, Axel Hecht wrote:

> On to the actual privacy policy: I think there's a host of jargon and
>
> technical detail in that part. I'm afraid that's not all that
>
> human-readable, in particular for non-technical audience who's not
>
> native English speaker.
>
>
>
> Much of that is already in
>
> http://www.mozilla.org/en-US/legal/privacy/firefox.html, but I'd prefer
>
> to make things better. If we could reword it to just not say "snippet"
>
> at all, for example.
>
>
>
> Example of too much detail: does is really matter if the region is
>
> stored in HTML local storage instead of just stored locally?
>
>
>
> Axel

Hi Axel,

Right now the privacy policy serves two purposes, to give people an understanding of what happens to their data as well as give them detail about how a privacy impactful feature will work. Your comments actually apply to most of the policy and I'm sympathetic because I have the same issues with it. Because of this, I've been actually rewriting the whole thing with usability and context in mind (with UX, engineering and product folks involved) so we can serve both the average user as well as the privacy conscious or advocate. I'd love to have you involved as well.

Until we have a better framework, the policy needs to serve both purposes, which is why this section has so much detail. Since location is impactful from a privacy perspective, it's good for the privacy conscious user to know how it works in reasonable detail.

We'll also be working on making sure as many folks as possible can access and understand our policies - this is another place we should be working together as well.

I've taken some of your input to try and soften the section a bit - my recommendation is to get the feature up, provide a reasonably complete description per below and work on the v2 privacy policy that would improve the flow for the average user.

//Begin policy text:

Firefox's default home page (<about:home>) loads small bits of information which that we think will be useful to you. We call these "snippets". You can see them right below the search bar.

Once per day, Firefox gets new snippets from Mozilla. Whenever you see a snippet, that snippet makes a request to Mozilla, so that we can count how often snippets are viewed. This request to Mozilla sends the name of the snippet and is securely transmitted over HTTPS. Aside from this and standard log data collected as a part of any web request, snippets in Firefox does not send other information to Mozilla.

To help display relevant snippets, your Firefox browser sends Mozilla a monthly request to resolve your location at a country level using your IP address. We then send that country level information back to your Firefox browser, where it's stored locally. Your Firefox browser (not our web servers) will then pick snippets to show you based on the locally stored country information.

Aside from providing you with the snippets service, we use the information from these requests to estimate what fraction of Firefox users click on each snippet (broken down into general categories like Firefox version and geographic area). We will not use any of the information in this request to attempt to identify you or your activity anywhere else online, and we aggregate the info we receive into these general categories as soon as is practical.

You can turn off snippets by following the instructions here: https://support.mozilla.org/en-US/kb/How%20to%20set%20the%20home%20page.

[Jishnu]

On Thursday, March 28, 2013 12:39:18 PM UTC-7, Axel Hecht wrote:

> On to the actual privacy policy: I think there's a host of jargon and
>
> technical detail in that part. I'm afraid that's not all that
>
> human-readable, in particular for non-technical audience who's not
>
> native English speaker.
>
>
>
> Much of that is already in
>
> http://www.mozilla.org/en-US/legal/privacy/firefox.html, but I'd prefer
>
> to make things better. If we could reword it to just not say "snippet"
>
> at all, for example.
>
>
>
> Example of too much detail: does is really matter if the region is
>
> stored in HTML local storage instead of just stored locally?
>
>
>
> Axel

Hi Axel,

Right now the privacy policy serves two purposes, to give people an understanding of what happens to their data as well as give them detail about how a privacy impactful feature will work. Your comments actually apply to most of the policy and I'm sympathetic because I have the same issues with it. Because of this, I've been actually rewriting the whole thing with usability and context in mind (with UX, engineering and product folks involved) so we can serve both the average user as well as the privacy conscious or advocate. I'd love to have you involved as well.

Until we have a better framework, the policy needs to serve both purposes, which is why this section has so much detail. Since location is impactful from a privacy perspective, it's good for the privacy conscious user to know how it works in reasonable detail.

We'll also be working on making sure as many folks as possible can access and understand our policies - this is another place we should be working together as well.

I've taken some of your input to try and soften the section a bit - my recommendation is to get the feature up, provide a reasonably complete description per below and work on the v2 privacy policy that would improve the flow for the average user.

//Begin policy text:

Firefox's default home page (<about:home>) loads small bits of information which that we think will be useful to you. We call these "snippets". You can see them right below the search bar.

Once per day, Firefox gets new snippets from Mozilla. Whenever you see a snippet, that snippet makes a request to Mozilla, so that we can count how often snippets are viewed. This request to Mozilla sends the name of the snippet and is securely transmitted over HTTPS. Aside from this and standard log data collected as a part of any web request, snippets in Firefox does not send other information to Mozilla.

To help display relevant snippets, your Firefox browser sends Mozilla a monthly request to resolve your location at a country level using your IP address. We then send that country level information back to your Firefox browser, where it's stored locally. Your Firefox browser (not our web servers) will then pick snippets to show you based on the locally stored country information.

Aside from providing you with the snippets service, we use the information from these requests to estimate what fraction of Firefox users click on each snippet (broken down into general categories like Firefox version and geographic area). We will not use any of the information in this request to attempt to identify you or your activity anywhere else online, and we aggregate the info we receive into these general categories as soon as is practical.

You can turn off snippets by following the instructions here: https://support.mozilla.org/en-US/kb/How%20to%20set%20the%20home%20page.

[Axel Hecht]

On 02.04.13 00:13, Jishnu wrote:
> On Thursday, March 28, 2013 12:39:18 PM UTC-7, Axel Hecht wrote:
>
>> On to the actual privacy policy: I think there's a host of jargon and
>>
>> technical detail in that part. I'm afraid that's not all that
>>
>> human-readable, in particular for non-technical audience who's not
>>
>> native English speaker.
>>
>>
>>
>> Much of that is already in
>>
>> http://www.mozilla.org/en-US/legal/privacy/firefox.html, but I'd prefer
>>
>> to make things better. If we could reword it to just not say "snippet"
>>
>> at all, for example.
>>
>>
>>
>> Example of too much detail: does is really matter if the region is
>>
>> stored in HTML local storage instead of just stored locally?
>>
>>
>>
>> Axel
> Hi Axel,
>
> Right now the privacy policy serves two purposes, to give people an understanding of what happens to their data as well as give them detail about how a privacy impactful feature will work. Your comments actually apply to most of the policy and I'm sympathetic because I have the same issues with it. Because of this, I've been actually rewriting the whole thing with usability and context in mind (with UX, engineering and product folks involved) so we can serve both the average user as well as the privacy conscious or advocate. I'd love to have you involved as well.
>
> Until we have a better framework, the policy needs to serve both purposes, which is why this section has so much detail. Since location is impactful from a privacy perspective, it's good for the privacy conscious user to know how it works in reasonable detail.
>
> We'll also be working on making sure as many folks as possible can access and understand our policies - this is another place we should be working together as well.
>
> I've taken some of your input to try and soften the section a bit - my recommendation is to get the feature up, provide a reasonably complete description per below and work on the v2 privacy policy that would improve the flow for the average user.
>
> //Begin policy text:
>
> Firefox's default home page (<about:home>) loads small bits of information which that we think will be useful to you. We call these "snippets". You can see them right below the search bar.
>
> Once per day, Firefox gets new snippets from Mozilla. Whenever you see a snippet, that snippet makes a request to Mozilla, so that we can count how often snippets are viewed. This request to Mozilla sends the name of the snippet and is securely transmitted over HTTPS. Aside from this and standard log data collected as a part of any web request, snippets in Firefox does not send other information to Mozilla.
>
> To help display relevant snippets, your Firefox browser sends Mozilla a monthly request to resolve your location at a country level using your IP address. We then send that country level information back to your Firefox browser, where it's stored locally. Your Firefox browser (not our web servers) will then pick snippets to show you based on the locally stored country information.

I guess this is probably the other way around? The client requests, the
server filters and returns a subset of all the available snippets?

> Aside from providing you with the snippets service, we use the information from these requests to estimate what fraction of Firefox users click on each snippet (broken down into general categories like Firefox version and geographic area). We will not use any of the information in this request to attempt to identify you or your activity anywhere else online, and we aggregate the info we receive into these general categories as soon as is practical.
>
> You can turn off snippets by following the instructions here: https://support.mozilla.org/en-US/kb/How%20to%20set%20the%20home%20page.
>

The text looks better, but I think there are some grammar nits. I'd
leave those up to a native speaker, though. Examples would be "which
that we think" and "snippets ... does".

Axel

[Jishnu]

In other web services, yes, but my understanding is that the server sends the whole list of snippets - the resolution and picking of snippets is done client side.

>
> > Aside from providing you with the snippets service, we use the information from these requests to estimate what fraction of Firefox users click on each snippet (broken down into general categories like Firefox version and geographic area). We will not use any of the information in this request to attempt to identify you or your activity anywhere else online, and we aggregate the info we receive into these general categories as soon as is practical.
>
> >
>
> > You can turn off snippets by following the instructions here: https://support.mozilla.org/en-US/kb/How%20to%20set%20the%20home%20page.
>
> >
>
> The text looks better, but I think there are some grammar nits. I'd
>
> leave those up to a native speaker, though. Examples would be "which
>
> that we think" and "snippets ... does".
>

Ok we'll make those changes.

>
>
> Axel

[Jishnu]

In other web services, yes, but my understanding is that the server sends the whole list of snippets - the resolution and picking of snippets is done client side.

>

> > Aside from providing you with the snippets service, we use the information from these requests to estimate what fraction of Firefox users click on each snippet (broken down into general categories like Firefox version and geographic area). We will not use any of the information in this request to attempt to identify you or your activity anywhere else online, and we aggregate the info we receive into these general categories as soon as is practical.
>
> >
>
> > You can turn off snippets by following the instructions here: https://support.mozilla.org/en-US/kb/How%20to%20set%20the%20home%20page.
>
> >
>
> The text looks better, but I think there are some grammar nits. I'd
>
> leave those up to a native speaker, though. Examples would be "which
>
> that we think" and "snippets ... does".
>

[Doug Turner]

Winston,

Hey there. Nice changes to the policy. Just a few questions. Not sure
you can answer all of them.

Should the privacy policy have a nice link to show a user how to opt-out
of getting these location specific notifications?

How does the privacy policy change for Android? Last I heard they had
the idea of using the Android Notification area. If so, it is much more
in your face and probably requires a lot more buy off and thinking about
user impact.

Doug

[Axel Hecht]

Yeah, this is a tricky combination, not sure if it needs to be more precise.

I looked at
https://snippets.stage.mozilla.com/3/Firefox/18.0a1/20130406030922/Darwin_Universal-gcc3/de/nightly/Darwin%2011.4.0/default/default/,
and what happens is this:

You get a localized set of snippets in one language. There's code in
that snippet set that goes through the snippets for that language, and
associates them with countries or "none". The snippets the code chooses
from are those for your country and the ones for "none".

I didn't get that in the policy statement, but that's probably OK.

[Winston Bowden]

Hi Doug,

Sorry for the slow response. Answers below.

On Thursday, April 4, 2013 11:43:33 PM UTC-4, Doug Turner wrote:
> Winston,
>
>
>
> Hey there. Nice changes to the policy. Just a few questions. Not sure
>
> you can answer all of them.
>


> Should the privacy policy have a nice link to show a user how to opt-out
>
> of getting these location specific notifications?

Yes! We included that.

> How does the privacy policy change for Android? Last I heard they had
>
> the idea of using the Android Notification area. If so, it is much more
>
> in your face and probably requires a lot more buy off and thinking about
>
> user impact.

Right now, this is just related to the desktop snippet.