The code in the browser is a stub. No data gets collected let alone sent anywhere until the user adds a Pocket account. Pocket updated their privacy policy, and they open-sourced the browser integration code. https://venturebeat.com/2015/06/09/mozilla-responds-to-firef...
But based on the article, it wasn't addressed until users raised a stink about it. And it wasn't just privacy, it was also closed-source, unnecessary features that should be an addon, etc.
Why would it be addressed before anyone complained? And it was planned as part of the Readability feature, which is very popular and not considered "unnecessary". But FF devs were having a hard time making a good read-it-later UI and decided to use Pocket instead of reinventing the wheel.
Edit: To be clear, I think the browser code was always a stub, and the privacy policy was modified before the feature launched as part of Firefox.
My concern is that Mozilla has been on a "Sure, you can provide feedback, but we're gonna do it anyway" streak. Pocket is quite unnecessary, and would be a great candidate for an add-on. I don't know their reasons for bringing it in, but it seems pretty cut and dry that there were a lot of users who didn't want it even after it was cleaned up, and Mozilla ignored them.
I think you're probably just underestimating how popular it is. Tagging activity tripled from 2012 to 2017. They had 10 million monthly active users in February when Firefox bought them.
Oh, it’s simple. Just comply with EU law, and it’s all okay.
That includes:
1. You can not collect anything without explicit opt-in
2. You can not transmit any data to a third party
3. If a user requests it, you have to provide all data stored about them, and have to provide a way for them to delete all of that. (And you have to provide this at least once every 12 months via letter, fax or email for free) (compare §34 BDSG)
That includes IP addresses (just connecting to a socket without a user explicitly starting that action), names, emails, hashed IPs, it includes usernames, CC data, messages, interactions with webpages.
Anything that in any way is connected to a person is covered by this.
This directive is also the origin of the cookie disclaimers, which require opt-in before collecting statistics or loading any third party tracking solution.
But be aware, in May 2018 it all changes as the new EU GDPR comes into force, and that’s a bit more restrictive (and even applies to anyone processing or storing data of EU citizen, no matter where the processing entity is located)
