How privacy friendly are Firefox ESR, Edge for Business, Vivaldi and Brave?
With the permission of SLM Cloud, we are publishing this blog about our findings. For questions about the research, please contact the press spokesperson at the Dutch Ministry of Justice and Security, +31 (0)70 370 73 45.
Technical research questions
Privacy Company tested the data processing by the four browsers. For each browser, there is a separate report that answers 7 technical questions, with sub questions. Privacy Company also created a comparison table for the four browsers. In addition to the technical results this table includes a legal analysis of the GDPR role and processing purposes of the manufacturers, as well as advice to it-administrators for privacy friendly settings.
7 research questions
- Can IT-administrators configure privacy friendly settings in a centralised manner?
a. Is the change to another default search engine effective?
b. Does the in-built security filter work?
c. Does the traffic to the browser manufacturer include personal data?
d. Is there a cloud management environment?
- Can IT-administrators centrally disable services in the browser for which the manufacturer is the data controller?
- How effective is the ‘strict’ tracking protection against third party cookies?
- How effective are the privacy friendly settings in preventing network traffic from the browser to the manufacturer?
- Does the manufacturer adequately document the network traffic sent to itself (including traffic sent to potential subsidiaries that act as data controllers)?
- Does the manufacturer adequately answer a Data Subject Access Request?
- What additional measures can government organisations take to minimise or prevent sharing of personal data?
Results
All four browser manufacturers collect some personal data. If organisations deploy the recommended privacy friendly settings, they can limit this data traffic to the IP address of the end user, with some information about plug-ins and version updates. The only exception is Microsoft Edge for Business. Through its browser Microsoft collects more personal data from end users than the other 3 browser manufacturers. Edge for Business sent Telemetry Data to Microsoft, and traffic to Microsoft’s search engine Bing, even though Privacy Company did not actively use Bing and attempted to block all traffic to Bing. However, the recommended group policy to change the default search provider (Bing) was ineffective.
The quality of the documentation of the personal data processing varies: Mozilla and Brave publish sufficiently detailed and up to date documentation about the personal data they collect, while Microsoft and Vivaldi provide insufficient information. Vivaldi committed to update its information by 30 November 2026, but Privacy Company has not yet seen the new information. None of the 4 browsers provide all required transparency about the retention periods, data collection through add-ons and processing by third parties.
All 4 browser manufacturers act in a GDPR role as data controller. The only exception is the Mozilla Foundation: it has recently announced it will act as data processor for the new Firefox Enterprise. The other 3 browser manufacturers do not have such plans.
While the Mozilla Foundation provided an extensive reply to the Data Subject Access Request, Microsoft refused to answer if the test user did not log in with a Microsoft account. Privacy Company did not file such access requests with Vivaldi and Brave because it could observe the limited personal data in the intercepted outgoing data traffic. Both browsers by default do not send standard Chromium telemetry to Google and do not set analytical cookies on their websites.
Three of the four tested browsers are built on the open source software Chromium developed by Google. Firefox ESR is the only tested browser built on a different open source engine. While Vivaldi and Brave rely on the Chrome Webstore for add-ons and plugins, Firefox and Edge refer users to Mozilla and Microsoft stores.
The 3 US American owned browsers transfer personal data to the USA and to other countries outside of the European Economic Area (EEA): Microsoft potentially to 30 third countries, Mozilla to 2 or 3, while Brave does not document transfers to third countries. Only Vivaldi offers EEA-exclusive data processing, in Iceland – provided admins block access to the Chrome webstore.
Finally, Privacy Company also tested the effectivity of tracking protection in the 4 browsers. All but Microsoft Edge were reasonably effective. Both Brave and Firefox ESR use technical cookie jar separation to prevent websites from settings persistent cookies with unique identifiers that can be used for tracking purposes without consent. Edge on the other hand shares personal data with Microsoft subsidiaries MSN, Bing and Office through tracking cookies with unique identifiers, even without visiting MSN and Bing. Vivaldi has a commercial functionality called DirectMatch. This involves the use of bookmarks and standard search terms to generate traffic to sponsors. Vivaldi Technologies AS does not document the exact data processing through these referrals, but if a user types a keyword, the browser can redirect the user to a sponsored website. Such a sponsored website can subsequently set and read tracking cookies as it now qualifies as ‘first party’.
The comparison table helps organisations identify their privacy risks and consider using an alternative more privacy friendly browser. The four reports include a table with the recommended privacy-friendly group policies for administrators at government organisations to centrally configure the browser for workstations.
- Memo SLM Cloud summarising the findings for Dutch government organisations including an advice for the short and long term
- The comparison table of the four browsers on Open Government
- Verification Report Firefox ESR
- Verification Report Edge for Business
- Verification Report Brave
- Verification Report Vivaldi
