Mozilla recently announced a partnership with the AI company Exa. They say:
Firefox is investing in partnerships with companies like Exa.ai to bring deep expertise in specific areas while sharing our commitment to user choice, privacy, and transparency.
They continue:
We’re picking partners for the same reason each time: people who think AI in a browser should work for you, not the other way around.
This is a little ironic when Exa’s CEO describes it differently:
We’re organizing the world’s knowledge, but this time for AI
…But I digress. Mozilla promises three things above.
- User choice
- Privacy
- Transparency
I’ll be looking into privacy exclusively (and leave the fact Exa is an undisclosed member of the Andreesen Horowitz portfolio for another day).
A Privacy Audit
Exa’s privacy policy is short and troubling. It starts with an entitled attitude towards private data that might be available online:
Although publicly available data is not considered “personal information” under certain data privacy laws, we have nevertheless described how we collect, use and disclose such information…
This is an appeal to technical legality: common sense would dictate that a publicly leaked database of social security numbers would be personal information, but apparently the possibility that it’s not explicitly enumerated under some (unnamed) privacy laws irks the AI company.
Not a great start, but maybe things get better…
When you use or access the Services, we collect certain categories of information about you from different sources. In addition to the specific uses discussed below, we may use this information to provide and improve the Services and to maintain our business relationship… and protecting our rights and the rights of our employees, users or other individuals.
What other individuals need this company’a protection? How will information be used to “improve” their product? These questions are unanswered. But we do get told a bit more about sources:
We and third parties also automatically collect certain information about your interactions with the Services, including through cookies, pixels or other tracking technologies. This information is collected and used to better understand user interactions with the Services, run analytics, monitor and improve performance, measure engagement and to tailor and enhance user experience. Such information includes:
Device information, such as device type, operating system, unique device identifier, and internet protocol (IP) address.
Location information, such as approximate location based on IP address.
Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps, clickstream data (e.g., page requests, page views, how much time is spent on a page, content viewed or interacted with, text entered, etc.), interactions with marketing emails
That’s a ton of data!
Exa describes how they refuse to honor requests not to track you.
Your browser settings may allow you to transmit a “Do Not Track” signal when you visit various websites. Like many websites, our website is not designed to respond to “Do Not Track” signals received from browsers.
Exa admits they knowingly collect personal data by default, and it’s unclear how or if Firefox Smart Window uses can steer clear of the privacy problems.
On default plans, we use anonymized data…
[You can] opt out of Exa’s collection of brokered personal information, opt out of its database, or out of its certain sale of data customers…
Opt out of certain, but not all, sales.
Exa has a second privacy page that describes its compliance with requests to delete private data or opt out of selling it. It received 50 total requests to delete or opt out of selling private data, and “complied”, which can include incomplete compliance for some reason, with only 5 of them. That’s a 10% compliance rate.
[new] Exa monetized “finding” individual people
I just found out about another skeleton in Exa’s closet: the stalkerish People Search that scraped and started publicizing work information. From a LinkedIn post:
I can pull entire staff lists for companies. I can [get] an individual’s work history. I can pull lists of people with a particular job title in a geographical area. I can also combine all this with richer company information and web search data…
Exa are very brave as I can’t imagine LinkedIn likes it very much.
Does this fit Mozilla?
On privacy alone: no.
Mozilla promises a commitment to user privacy, and promises to only work with companies that share that commitment. Exa demonstrates hostility towards user privacy.
Maybe the New, AI-First Mozilla has abandoned this charter, but their website still says:
Individuals’ security and privacy on the internet are fundamental and must not be treated as optional.
Yeah, don’t worry, Americans don’t know what he’s actually saying half the time either.
Right again. If only they could figure out what to do about it.
Australia is one of the countries banning teens from social media. Shouldn’t they be able to ban OpenAI from their country too? Just give Sammy and Co a restraining order? Certainly makes more sense than the social media stuff, as companies can actually be held liable for things they intentionally do.