Come Back to Firefox. Meta Never Left.
On Sunday, Mozilla launched Come Back to Firefox, which it's calling one of its most ambitious campaigns yet. Two 30-second spots on NBC, with Germany, France and the UK up next. They got the band back together. Numa Numa Guy. Bad Luck Brian. Overly Attached Girlfriend. Annoying Orange, who apparently now has opinions about forced AI features. The pitch: the internet you loved is still out there, Big Tech tracks you everywhere, and Firefox is the independent way back.
I've wanted to root for Firefox for a long time. Back in February, in The Ad Blocker War, I pointed out that Firefox and its forks are in a better spot than anything Chromium-based when it comes to blocking ads and trackers. Firefox runs the last major browser engine that isn't Google's or Apple's, and the web needs it.
Then, earlier this week, Don Marti posted a thread on Mastodon about Meta ignoring a Brazilian court order, and added one line at the end: this is the company Mozilla decided to work with on an in-browser ad tracking feature. My reply was short. I'm not going back to Firefox itself. Meta cannot be trusted, full stop. If you build them a door, they will find a way to walk through it.
And the door thing isn't a figure of speech. Last year, researchers caught Meta's tracking pixel quietly passing browser data to the Facebook and Instagram apps running in the background on Android phones, through a local back channel nobody was supposed to be using for that. It tied people's web browsing to their accounts and walked right past incognito mode and cookie clearing. It had been going on since the previous September. Meta stopped the day the research went public. Firefox was one of the browsers that needed a fix.
That's the company. That's the track record. And that's who gets a seat at the table designing the tracking they want built into your browser.
Forks like Librewolf and Waterfox are still where I'd point people, for now. The engine is still worth having. But "for now" is doing real work in that sentence. Forks pull from upstream. Whatever lands in Firefox lands on their doorstep too, and how it's built decides how much work it is to get rid of it. A setting you can flip off is one thing. Something woven through the browser's internals is a merge headache every single release, forever, for small volunteer teams who already have plenty to do.
Sure, a fork could hard fork. Cut the cord to upstream and never take another Mozilla change. But then they're on their own with an entire browser engine. It's all open source, but "open" isn't the same as "easy." That includes the JavaScript engine and the crypto library underneath everything, each one a full-time job. Mozilla shipped security patches on October 13th, 20th and 21st alone this month. And some of the security work isn't even code. When a certificate authority's keys got compromised last week, Mozilla pushed a block to Firefox within hours from its own servers. A hard fork has to build and run all of that itself.
Which is why I need to talk about what Mozilla engineers have been doing at the W3C all year. With Meta.
The Spec
It's called Attribution Level 1. It's a proposed web standard that builds ad measurement directly into your browser.
Here's how it works, in plain English. When a site shows you an ad, it asks your browser to remember that you saw it. Your browser keeps a running log of ads from the sites you visit. Later, when you buy something somewhere else, that store asks your browser to check the log and generate a "conversion report." The report goes off, encrypted, to an aggregation service, which combines it with reports from lots of other people, adds some statistical noise, and hands the advertiser a tally of which ads "worked."
The pitch is that nobody learns that _you_ specifically saw the ad and bought the thing. Aggregation plus differential privacy. Better than cookies. Better than pixels.
Now look at who's writing it. The current draft, published October 14th, lists six editors: two from Google, two from Mozilla, and two from Meta.
(For the record, Apple isn't on the masthead, despite some coverage saying otherwise. That's not the reassurance it sounds like. Apple already has its own version baked into Safari, done the Apple way, on Apple's terms. And Google already pays Apple billions a year to be Safari's default search, so whatever Apple doesn't measure itself, Google hoovers up from Safari and iOS anyway. If this spec pushes more ad money toward search, Apple gets paid either way. Why sign your name to something when you already get a cut?)
It's also very much alive. The publication history shows nearly sixty working drafts since last December, more than forty of them since March. That's not a stalled side project. That's a spec somebody wants finished.
What's Not In It
Marti has been covering what he calls the attribution cartel since June. He pointed this out first, and I went and checked: there's no section on consent.
There's a section on _disabling_ the API. That's not the same thing.
The permissions for both halves of the API, recording impressions and measuring conversions, default to on for every site. The spec's own reasoning is that it makes integrating outside services simpler. Simpler for whom is left as an exercise for the reader.
It gets better. The spec argues that attribution should be enabled for _all_ users, because bigger groups make the math work better. It acknowledges some people won't like that. Its answer for those people is a design where you can turn it off, but sites can't tell you did. You get to appear to participate.
And when you do turn it off? One of the W3C's own privacy reviewers filed an issue pointing out that, as written, the browser keeps sending messages to the advertiser's servers even with the API disabled. The messages are meant to be empty, so sites can't tell who opted out. The reviewer's point was that a user who switches it off, then watches their network traffic and sees the browser still talking to ad servers, is going to feel tricked. Or worse, like the browser is colluding with advertisers against them. As of this morning, that issue is still open.
That design choice matters for the forks, too. If the spec is built so that "off" has to look like "on" to the sites you visit, a fork that wants it gone has two bad options: keep the plumbing and play along, or rip it out and possibly make its users stand out from everyone else running Firefox.
And then there's the abstract. The very first paragraph of the spec says the API collects information about people across multiple websites, which "could be a significant risk to their privacy."
That's not a critic saying that. That's the spec describing itself.
We've Seen This One Before
If this feels familiar, it should. This is the third lap.
**February 2022.** Mozilla announced it had spent months working with Meta on an ad attribution proposal called Interoperable Private Attribution. The timing was, let's say, awkward. As XDA noted, Mozilla had launched a study with The Markup _the month before_ to track how Meta's pixels follow people around the web. And the blog post announcing the Meta partnership didn't get shared on Mozilla's or Firefox's official Twitter accounts. Funny how that works.
**June 2024.** Mozilla bought Anonym, an ad measurement startup founded by two former Meta ad executives.
**July 2024.** Less than a month later, Firefox 128 shipped "Privacy-Preserving Attribution," a direct descendant of that Meta collaboration, switched on by default. Privacy Guides caught it. noyb filed a complaint with the Austrian data protection authority. Mozilla's CEO at the time apologized for landing the code before explaining it, said the trial was never activated for external users, and promised to be transparent about tests and features going forward. The feature was eventually pulled from Firefox entirely.
Pulled from Firefox. Not from the standards process.
In April 2025 it showed up at the W3C as "Privacy-Preserving Attribution: Level 1." By December, it had dropped the "Privacy-Preserving" part of the name and become plain "Attribution Level 1."
One of the Mozilla editors on the current draft is Martin Thomson. The same Mozilla engineer who introduced the Meta collaboration back in 2022.
The People Who Buy Ads Aren't Buying It
Here's the part I didn't expect. Some of the loudest pushback isn't coming from privacy people. It's coming from advertising people.
Rick Bruner, who runs a marketing measurement firm, wrote to the working group in May arguing the spec treats attribution as if it measures whether ads _work_, when it really measures correlation. Somebody who was already going to buy the thing sees an ad on the way to buying it, and the ad gets the credit. He also pointed out that the measurement tricks needed to fix that depend on huge logged-in user bases. You know, the kind Meta and Google have and your local newspaper doesn't. He followed up with an op-ed in AdExchanger in June asking the industry to pay attention before the comment period closed.
The same day as Bruner's email, Chris Williams, a former president of IAB Canada, was blunter. Sophisticated marketers don't care about attribution, he wrote. It's "little better than voodoo." And handing all those conversion events to the people selling the ads just gives them a new way to commit fraud.
When the guy who used to run an advertising industry trade group is telling you your advertising standard is a bad idea, it might be a bad idea.
Marti's version of the argument is the one that sticks with me. Attribution naturally over-credits whoever is standing closest to the sale: search ads, social ads, app store ads. The channels that catch demand rather than create it. Bake that into every browser, and ad money drifts further toward exactly the platforms that are already eating everything. It also rewards anyone who can find people who are _about_ to buy and get an ad in front of them first, which is a pretty strong incentive for _more_ data collection elsewhere, not less.
Then there's the point he raised in Data Lake America: whoever controls the measurement controls the story the numbers tell. Those reports don't just go to marketers. They end up in front of legislators, as proof of how much small businesses supposedly depend on Big Tech.
And the ad blocker angle. A tracking feature built into the browser itself isn't something your uBlock Origin filter list was designed to touch. Marti's ask is that if this ships, extensions should at least be able to manage it the way they manage every other ad thing. To be fair, that one is actually moving. After EFF's Privacy Badger developer asked for it, the spec editors went to the WebExtensions working group, and the rough plan is to fold this API into the existing browser setting extensions already use to switch off ad measurement. Thomson called it a reasonable path. But it's a plan in a GitHub thread, built around a setting that only Chrome has today. It's not in the October 14th draft.
Read the Room
This is the third time in about a year I've watched Mozilla do something that makes me want to grab them by the shoulders.
First it was AI. Last December, Mozilla's new CEO announced Firefox would become an "AI browser". The backlash was loud enough that within days they promised a kill switch, and then they shipped Smart Window anyway, now running Mistral models. To their credit, it's opt-in and the kill switch is real. But the users who were the most loyal were the ones who asked for this the least.
Then it was Google. In June, Mozilla went to the appeals court in the Google antitrust case and argued its search deal was never "exclusive", then followed up in August warning that a ban on those payments could force it out of the browser business. I get why. Mozilla's own CFO testified last year that roughly 85% of the money comes from Google. But "independent browser" and "defending Google's payments in federal court" are an uncomfortable pair of sentences. And since Firefox still defaults to Google Search, every user this new campaign wins back is more traffic for Google, too.
And now Meta.
Let's be clear about who the co-author is. Last week, in Founder Alignment, I wrote about a New Mexico judge ordering Meta to pay $25 billion after a jury found Facebook had made 26 false or misleading statements about user privacy. And that's not the only courtroom. In Brazil, the electoral court has ordered Meta to treat President Lula's campaign and Flávio Bolsonaro's campaign equally, after complaints that its platforms were favoring Bolsonaro. The full court upheld the order and set a daily fine of roughly $99,000 that could double. Then two advocacy groups filed new evidence that WhatsApp and Instagram search were still putting Bolsonaro up top and pairing Lula with insults. To be fair, the groups say they haven't proven bias; they're asking the court to look. Meta denies favoring anyone and blames earlier problems on technical failures.
Marti's take on that is the one I keep coming back to. Deliberate or not, every big platform has bugs and moderation failures all the time. The difference is whose problems get noticed and fixed quickly. Now imagine that same company helping define how every browser decides which ads, and which sites, "worked."
That's the company Mozilla's engineers are co-writing a browser privacy standard with.
And then, on Sunday, Mozilla put a meme-powered ad campaign on national TV telling people to come back to Firefox to get away from corporate tracking.
In Fairness
I'll give Mozilla the parts it's owed.
Nothing from this spec is in Firefox right now. The 2024 experiment is gone. That matters, because people already assume otherwise. In that same Mastodon thread, someone started wondering if this was why their mom was suddenly buried in pet supply ads, and Marti had to step in and clarify that Firefox doesn't currently do attribution tracking. Which tells you how much trust Mozilla has already burned: people hear "Mozilla" and "Meta" in the same sentence and assume the worst is already shipping. Aggregated, noise-added measurement genuinely is less invasive than a Meta pixel firing on every page you load, and Mozilla has been arguing for two years that the realistic choice is between better ad tech and worse ad tech, not ad tech or none. There's a version of that argument where Mozilla being in the room is better than Google and Meta writing this alone.
Thomson has also been unusually candid about the downsides. In a July interview with Alan Chapell, as one write-up summarizes it, he conceded that attribution shows an ad and a sale are connected, not that one caused the other. He acknowledged that the privacy math hurts small advertisers more than big ones, and that Mozilla decided fixing that was a job for competition law, not the spec. Asked whether the incumbents would press their built-in advantage, his answer was "of course they will if they can get away with it."
I appreciate the honesty. I really do.
But being in the room isn't the same thing as co-signing the result. And the result, as of October 14th, is an on-by-default, no-consent-section, cross-site measurement system whose own abstract calls it a significant privacy risk, and whose off switch, as currently written, doesn't fully stop the browser from talking to ad servers. Mozilla's own engineer says the big players will take advantage if they can get away with it. Two of those big players are his co-editors.
Overly Attached
Of all the early-internet icons Mozilla brought back for this campaign, I keep coming back to Overly Attached Girlfriend.
She's the one Mozilla picked to stand for tracking. In the campaign post, she may have wanted to know everything about you, "but your browser didn't need to."
Four years. A Meta partnership announced quietly while studying Meta's tracking. A startup run by Meta's former ad executives. A default-on experiment in Firefox. An apology. A rename. And now a W3C spec with Meta's name right there on the masthead, next to Mozilla's.
Come back to Firefox, they said.
Meta never left.