Mozilla Corporation

SEARCH & BROWSERS

LAST UPDATED 3 AUG 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Mozilla Corporation is the wholly owned taxable subsidiary of the non-profit Mozilla Foundation and is the data controller named in Firefox and Mozilla-account privacy notices, which describe data-minimization commitments alongside collection of technical, interaction and advertising-related data. In 2024 the advocacy group noyb filed a GDPR complaint with the Austrian data protection authority alleging that Mozilla's "Privacy-Preserving Attribution" feature in Firefox was enabled by default without user consent, and in the same year Mozilla ended a data-removal partnership with Onerep after reporting that the vendor's CEO had undisclosed ties to data-broker sites. Mozilla's own privacy notices disclose specific third-party data flows (e.g., payment processors and its VPN partner Mullvad) and state a general policy against renting or selling personally identifying information.

TIMELINE

NO ENTRIES ON FILE YET.

ULTIMATE PARENT

Mozilla Corporation

THIS FILE HEADS ITS OWN CHAIN.

SUBSIDIARIES ON FILE (1)

TOOLS WE RECOMMEND

PLUS

RECEIPTS

16 ON FILE

COLLECTION

The Firefox Privacy Notice states that Mozilla collects technical and interaction data such as the position, size, views and clicks on New Tab content or ads, to personalize future content including sponsored content.

mozilla.org ↗

[2025-12-17] · COLLECTION

Mozilla's Subscription Services Privacy Notice discloses that IP addresses are collected and retained in server logs for 90 days to approximate location for pricing/availability purposes and for fraud and abuse prevention across products.

mozilla.org ↗

OWNERSHIP TRANSPARENCY

Mozilla's official governance page discloses that the Mozilla Corporation is a wholly owned taxable subsidiary of the non-profit Mozilla Foundation.

mozilla.org ↗

[2024-12-09] · OWNERSHIP TRANSPARENCY

Mozilla Foundation's audited consolidated financial statements disclose that the Foundation has several wholly-owned for-profit subsidiaries, including Mozilla Corporation, that operate independently but are collectively referred to together with the Foundation as "Mozilla."

assets.mozilla.net ↗

[2013-08-02] · SHARING

Mozilla's 2013 Websites Privacy Policy states that Mozilla does not rent or sell personally identifying information to anyone, while noting that potentially-personally-identifying information may be shared with employees, contractors, service providers, subsidiaries and related organizations.

static.mozilla.com ↗

[2025-12-17] · SHARING

Mozilla's Subscription Services Privacy Notice discloses that when a user activates Mozilla VPN, internet traffic is encrypted and sent to Mozilla's partner Mullvad, and that payment records (including billing address and last four digits of a payment method) are shared with third-party payment providers Stripe, Apple, PayPal, or Google Pay.

mozilla.org ↗

TRACK RECORD

Mozilla's bug bounty is funded, not nominal: the published Client Bug Bounty Program pays cash rewards between $3,000 and $20,000 (USD) for valid critical and high-severity client vulnerabilities, with award levels set by a Mozilla Bounty Committee against published severity-rating criteria.

mozilla.org ↗

TRACK RECORD

Mozilla operates a public Security Bug Bounty Program with published eligibility rules and an explicit safe-harbour commitment not to threaten or bring legal action against researchers acting in good faith under the program.

mozilla.org ↗

[2021-08-31] · TRACK RECORD

Mozilla published an earlier Cure53 security audit of Mozilla VPN in August 2021, covering the same five client platforms and itemising each medium-or-higher finding, the fix applied, and in one case the risk Mozilla explicitly accepted and why - establishing a repeated, published external-audit cadence rather than a one-off.

blog.mozilla.org ↗

[2023-12-06] · TRACK RECORD

Mozilla commissioned and published a third-party security audit of Mozilla VPN by the Berlin firm Cure53, released in December 2023, covering the macOS, Linux, Windows, iOS and Android clients, with each medium-or-higher finding listed alongside the fix Mozilla applied and Cure53's confirmation, plus a link to the full report.

blog.mozilla.org ↗

[2024-03-28] · TRACK RECORD

In March 2024, Mozilla ended its partnership with data-removal vendor Onerep for its Mozilla Monitor Plus service after reporting that Onerep's CEO had undisclosed financial ties to data-broker and people-search websites; Mozilla stated that customer data itself was not at risk.

thenonprofittimes.com ↗

[2024-09-25] · TRACK RECORD

In September 2024, noyb filed a formal complaint with the Austrian data protection authority against Mozilla, alleging GDPR violations tied to the default enablement of Firefox's Privacy-Preserving Attribution feature without an opt-in consent mechanism.

noyb.eu ↗

[2024-12-31] · TRACK RECORD

Mozilla publishes recurring transparency reports carrying actual request and compliance counts. For 1 July to 31 December 2024 it reported 1 search warrant (1 produced), 23 subpoenas (7 produced), 0 court orders, 0 wiretap or pen register orders, 1 national security request (reported in the permitted 0-249 band), more than 250 government content-removal requests from Russia with 0 items removed, and 5,683 personal data requests.

mozilla.org ↗

[2026-05-28] · TRACK RECORD

Mozilla's Monitor Plus subscription service, which had relied on the Onerep data-removal partnership, was discontinued on December 17, 2025, roughly 20 months after the Onerep conflict-of-interest was first reported.

leakcheckme.com ↗

[2020-09-09] · TRACKING TECH

Mozilla's general privacy policy states that some data is collected automatically through its products, giving the example of Firefox checking in with Mozilla servers to see if it is up to date.

mozilla.org ↗

[2024-09-25] · TRACKING TECH

In September 2024, the privacy advocacy group noyb filed a complaint with Austria's data protection authority alleging that Mozilla enabled a "Privacy-Preserving Attribution" tracking feature in Firefox by default, without obtaining prior user consent, and that the feature lets the browser itself record and report on ad interactions across websites.

noyb.eu ↗

LAST REVIEWED 2026-08-03 · METHODOLOGY v1.7