788878 - Privacy Review for Android product announcements

Status: RESOLVED FIXED

(Privacy Graveyard :: Product Review, task, P1)

Description

[Sam Mott]

This is a bug to track the privacy review for the Firefox for Android feature Cloud To Device Messaging (specifically, the opt-out component of the feature).  

Background: The purpose of Cloud to Device Messaging is to provide a communication method that allows marketing to send a message to GA users that have Firefox for Android installed, and allows a message to be sent regardless of whether or not the application is currently open.  

Full Feature Page: https://wiki.mozilla.org/Features/Fennec/Cloud_to_Device_Messaging

We are exploring the range of service options that we have to send messages to user's devices. Privacy concerns could include: 
--opt-out capability
--storage of device tokens (to facilitate messaging)

This bug will be updated when design work begins.

Comment 1

[Sam Mott]

Closing as a duplicate of 749806

Comment 2

[Richard Newman [:rnewman]]

Not a duplicate of the Services notifications product.

Comment 3

[Richard Newman [:rnewman]]

Feature page:

https://wiki.mozilla.org/Features/Fennec/Android_Snippets

Meta bug: Bug 774497.

Comment 4

[Tom Lowenthal]

Could whoever is driving this schedule a 1h meeting with me next week (or later, if you're not yet ready)? Feel free to ping me on IRC in the mean time.

Comment 5

[Richard Newman [:rnewman]]

Thanks for the review today, Tom.

Summary of findings that I remember:

* If the set of collected data expands, new incremental review.
* Record server-side data with low-granularity timestamps: 15 minutes or an hour.
* Client preference string will be meaningless to most users. Explore alternatives.

What did I forget?

Comment 6

[JR Conlin [:jrconlin,:jconlin]]

One question arose after the meeting. Do we have to pay attention to the DNT flag?

The system does not track individual users, nor is any personally identifying information stored. We are, however, acting on elements of the user's agent and one behavior (browser idle time), however this information is combined with others and presented as a collected report.

Comment 7

[JR Conlin [:jrconlin,:jconlin]]

Additional note from metrics follow-up:

The current metrics system collects information the same way as our current logging does. (e.g. a timestamp is applied to records as they are recorded, and is per-second resolution.) This would be equivalent to a access log entry. 

There is some natural "fuzz" in that the client user agent collects a set of notifications, chooses one, and then presents it to the user who may or may not take action on it. In that case, we'll know that a user with a particular configuration requested some notices and that users have requested actions. It will not be easily correlatable to determine if those users are the same individuals.

The metrics folks are considering adding "delayed fuzz" to the timestamp, where after a period, the timestamp is decayed. This is not currently available.

Comment 8

[Tom Lowenthal]

Is there any reason that this bug needs to remain secret? Please object with 48h, so that I can make this public promptly if possible.

Comment 9

[Richard Newman [:rnewman]]

No objection from me.

Comment 10

[Mike Connor [:mconnor]]

I see no reason for this bug to remain secret.  The design docs and bugs are all public, and this is all in-house.

Comment 11

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

No objection here