Law Enforcement Guidelines
1. Introduction
This policy applies to official law enforcement or government agency requests for information about users of the products and services offered by Mozilla Corporation.
Mozilla Corporation is based in California, and is a wholly-owned subsidiary of Mozilla.org, a 501(c)(3) nonprofit organization that is controlled by Mozilla Foundation, a 501(c)(3) nonprofit organization. Other business organizations owned by Mozilla.org include:
Mozilla Corporation (going forward, “Mozilla”) generally cannot provide information about products, services, or users associated with other Mozilla-affiliated entities. Please visit those entities’ websites to learn how to contact them directly.
2. Commitment to Privacy
In accordance with the Mozilla Manifesto, Mozilla collects very little personal information about its users. Where we do collect user data, Mozilla will only disclose it:
- in response to valid legal process, or
-
where we have a good faith belief that
- an emergency creates a meaningful risk of death or serious bodily injury to a person, and the disclosure of user data is necessary to prevent that harm; or
- Mozilla is legally required to share the information under a statute or regulation.
3. Submission of Government Requests
Mozilla generally requires valid legal process to compel the disclosure of specific user data to a government. This means:
- A legitimate and properly scoped subpoena or court order from a U.S. court;
- A search warrant supported by probable cause and issued by an appropriate law enforcement authority; or
- For governments outside the United States, a Mutual Legal Assistance Treaty (MLAT) request, letter rogatory, or equivalent government-to-government legal process1.
Legal process can be served on Mozilla by email at legalrequest@mozilla.com, or by mail or personal service at the following addresses:
Mozilla Corporation
Attn: Legal requests
1875 Mission St
Ste 103
San Francisco, CA 94103
Mozilla Corporation
℅ National Registered Agents, Inc.
330 N. Brand Blvd
Glendale, CA 91203
We aim to respond to standard requests within two weeks of receipt.
Acceptance of legal process by any of the above means is for convenience. Mozilla reserves the right to object to subpoenas and law enforcement requests for any reason, including lack of jurisdiction or improper service.
4. Information to Include in Requests
Please include the following information in all requests:
- Requesting agency
- Authorized officer
- Official email address
- Account identifiers
- Categories of information sought
- Relevant date range
- Production deadline
We retain very little specific user information, and will be unable to respond to overly vague requests. If you are seeking specific categories of information about a user, please review the FAQ section of these guidelines before submitting your request.
Pursuant to California law, Mozilla will not disclose user information in response to a law enforcement request related to the investigation or prosecution of conduct associated with reproductive health services that are lawful in California. Accordingly, requests from law enforcement agencies outside California must either:
- include an express affirmation that the requested information is not sought in connection with an investigation relating to lawful reproductive health services; or
- provide sufficient information regarding the nature of the investigation to enable Mozilla to make this determination itself.
5. User Notice
Where possible, Mozilla will notify affected users about government requests for their information, except where:
- notice is prohibited by law or a court order;
- notice is likely to result in real-world harm;
- notice could be counterproductive (such as where an account has been compromised); or
- no identifiable information was disclosed.
In addition, we will only notify a user about a request where we possess sufficient information on how to contact that user. In practice, this means that users who have not provided Mozilla with any contact information will not be contacted.
Notice may be provided before or after the disclosure has been made, depending on the circumstances.
Mozilla will not notify users when it proactively discloses their information — such as when making reports to the National Center for Missing and Exploited Children.
6. Data Retention and Availability
In most cases, Mozilla does not retain much data after a user deletes their account. Where an account has been deleted, we may be able to confirm that the account existed, but we will generally not be able to provide further details about the account activity or the accountholder.
Preservation requests can be served by email at legalrequest@mozilla.com. Such requests should include sufficient information to allow us to identify all of the information that should be preserved, as well as the preservation period. If you seek further preservation beyond the originally-stated preservation period, you must provide an updated preservation request. Preservation requests must be served while an account is still active, in order to be effective.
7. Cost Recovery
In certain cases, particularly those involving unusual or burdensome requests, we may seek reimbursement for the cost of investigating and responding to law enforcement requests.
8. Authentication
Unless otherwise specified, all records produced by Mozilla in response to law enforcement requests are those created and maintained in the ordinary course of Mozilla’s business.
9. Contact information
Questions not covered in these guidelines, or related to a specific production or law enforcement response, can be sent by email to legalrequest@mozilla.com.
10. FAQ
In general, Mozilla collects and retains very little data about its users. Where we collect data about Internet activity, we generally do so in a de-identified fashion, so we can not link it back to a specific individual. For more information about how we collect data, please see our Privacy page, or the applicable Privacy Notice.
We frequently receive requests from law enforcement that we are unable to respond to. Frequent sources of confusion are listed below:
A. Firefox Browser Usage Data
The Firefox browser is a downloadable piece of software that sits on a user’s device. A given user’s browsing history is stored locally, and is not accessible to Mozilla. When a Mozilla accountholder enables the sync feature, their data is stored on a Mozilla server, but is end-to-end encrypted and not readable by Mozilla. Mozilla can determine whether the sync feature has been used and when the last sync date was, but it cannot determine what specific data was synced.
Mozilla does not have access to a user’s email content, social media account information or other online activity, and does not have access to user email addresses, unless those addresses have been used to create an account.
B. Search Activity and Results
The Firefox browser provides a portal for users to access third party search engines and websites. It does not operate or control those search engines and websites. Mozilla does not have a search engine product, and has no control over search engine results. The only websites that Mozilla controls are those located on a Mozilla domain (including but not limited to www.firefox.com, www.mozilla.com, www.mozilla.org, https://soloist.ai/ and various associated subdomains). If you have concerns about search results or about the contents of a particular website, please contact the operator of that search engine or website.
C. IP Address Data
Our IP logs only indicate what pages a specific device has visited on a Mozilla-controlled website, such as www.mozilla.org. These logs are only retained for 90 days, are not associated with any specific user, and do not include any information about activity on other websites. We generally object to requests for records related to a specific IP address, unless there is a demonstrable reason why the user’s activity on Mozilla’s website would provide significant value to the investigation.
D. Email Content
We do not have access to the contents of users’ email. We do not have user’s email addresses unless they have deliberately provided those addresses to us for communication or account creation purposes.
E. User Agent Strings
For historical and compatibility reasons, all user agent strings include the word Mozilla, regardless of whether the user was using the Firefox browser. This is true even for browsers that have never had any affiliation with Mozilla, such as Chrome and Safari.
Where a user agent string is associated with Mozilla, it is simply a generic identifier of device, OS, and browser. Mozilla is not able to identify a specific user based on a user agent string.
F. ECPA/SCA Requests
Firefox is not a remote computing service under 18 USC § 2711(2). The Firefox browser is downloadable software that lives on a user’s device, and can be used to access email, cloud storage, social media, and similar cloud-based services offered by other companies. Mozilla does not have information about specific user activities on third party platforms.
Where we do collect information about users’ online activity through another (non-Firefox) Mozilla product or feature, that information is generally encrypted, and is not readable by Mozilla. We are therefore generally unable to respond to requests based on 18 USC §§ 2701 et seq. (the Stored Communications Act).
G. MLAT Requirement for International Requests
As noted in section 3, Mozilla requires that requests be based on a valid legal process. For agencies outside of the United States, this generally means letters rogatory, or requests through the Mutual Legal Assistance Treaty (MLAT) Process. MLAT requests must be valid both in the United States and the originating country.
- Brazilian entities: Mozilla does not have an entity or corporate representative in Brazil. Requests must be submitted to our U.S. entity, and must be valid under U.S. law.
- EU agencies: Mozilla does not interpret Regulation (EU) 2023/1543 (the E-Evidence Regulation) as applicable to the Firefox browser. Mozilla will therefore generally request an MLAT for EU law enforcement requests.