Tom Ritter from Mozilla wrote a post earlier this year: telemetry helps. you still get to turn it off. He walks through features telemetry helped him ship in Firefox and argues that thoughtfully collected telemetry is valuable for developing features that protect user privacy and security. I agree with him. What does telemetry have to look like before a privacy-focused browser can justify collecting it? I’ll give Brave’s perspective.

Brave’s Privacy-Preserving Product Analytics (P3A) is built on STAR, which only lets us decrypt a value once at least K users have reported the same one (K-anonymity, in other words). We then built Nebula on top of STAR. Nebula adds sampling and probabilistic dummy values, which upgrades STAR’s guarantee to formal differential privacy. We also use Oblivious HTTP wherever we can, so Brave servers can’t see users’ IP addresses.

Brave goes pretty far when it comes to transparency: every analytics question we ask lives in a public human-readable list and new questions need privacy review. We go back through old questions and deprecate the ones that are no longer worth collecting (manually for now, though we’re working on automating it). Telemetry should pay rent.

Finally, users should be able to turn it off. That’s the title of Tom’s post, and I agree that no amount of privacy engineering replaces the user’s right to say no. In Brave that’s a toggle at brave://settings/privacy.

If you want the longer version of how STAR lets us ship features faster and more safely, I covered it in my USENIX PEPR 2023 talk.