# Mozilla VPN privacy rating

VPN service from Mozilla that runs on Mullvad's WireGuard server network. The apps are open source under MPL-2.0 and require a Mozilla account.

## Summary

Mozilla VPN scores 56 out of 100 (grade D) on the VPN providers criteria. It meets 5 of 12 criteria: no ads or data sales, transparency report, tells users about requests, open-source apps and modern protocols. It partly meets open source, independent audit, TLS configuration, security headers and audited no-logs policy. It does not meet no trackers or telemetry and anonymous payment. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade B and Mozilla HTTP Observatory grade B.

- Website: https://www.mozilla.org/en-US/products/vpn/
- Source code: https://github.com/mozilla-mobile/mozilla-vpn-client
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Windows, macOS, Linux, Android, iOS
- Home page trackers: Google Tag Manager
- Category: [VPN providers](https://privacyratings.com/vpns/)
- Also rated: [Firefox Private Relay](https://privacyratings.com/email-forwarding/firefox-private-relay/) (Email forwarding and aliases), [Firefox Focus](https://privacyratings.com/browsers/firefox-focus/) (Browsers), [Firefox](https://privacyratings.com/browsers/firefox/) (Browsers), [Facebook Container](https://privacyratings.com/browser-extensions/facebook-container/) (Browser extensions), [Firefox Multi-Account Containers](https://privacyratings.com/browser-extensions/firefox-multi-account-containers/) (Browser extensions), [Firefox Translations](https://privacyratings.com/translation/firefox-translations/) (Translation)
- Grade: D (56/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | The apps are open source under MPL-2.0. The server network, run by Mullvad, is not. | https://github.com/mozilla-mobile/mozilla-vpn-client/blob/main/LICENSE.md |
| No trackers or telemetry | No | Campaign and device data is shared with the Adjust attribution service. App interaction data is off by default. | https://www.mozilla.org/en-US/privacy/subscription-services/ |
| No ads or data sales | Yes | Funded by paid subscriptions. No ads. | https://www.mozilla.org/en-US/products/vpn/pricing/ |
| Independent audit | Partial | Full Cure53 report on the client apps is public, but the audit is more than three years old. | https://blog.mozilla.org/security/files/2023/12/Cure53-Final-Audit-Report.pdf |
| Transparency report | Yes | Mozilla publishes counts of government and legal requests, most recently each year. | https://www.mozilla.org/en-US/about/policy/transparency/ |
| Tells users about requests | Yes | Mozilla states it notifies affected users of requests unless legally prohibited. | https://www.mozilla.org/en-US/about/policy/transparency/ |
| TLS configuration | Partial | Grade B | https://www.ssllabs.com/ssltest/analyze.html?d=www.mozilla.org&hideResults=on |
| Security headers | Partial | Grade B (75/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.mozilla.org |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Audited no-logs policy | Partial | The privacy notice states neither Mozilla nor Mullvad keeps logs of network traffic. Not audited for Mozilla VPN. | https://www.mozilla.org/en-US/privacy/subscription-services/ |
| Anonymous payment | No | A Mozilla account with an email address and payment by card, PayPal, Apple or Google Pay are required. |  |
| Open-source apps | Yes | Apps for Windows, macOS, Linux, Android and iOS are open source. | https://github.com/mozilla-mobile/mozilla-vpn-client |
| Modern protocols | Yes | WireGuard is the protocol used. | https://www.mozilla.org/en-US/products/vpn/features/ |

Source: https://privacyratings.com/vpns/mozilla-vpn/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/vpns/mozilla-vpn.md