What is browser telemetry?

Browser telemetry is technical and usage data your browser automatically sends back to the company that makes it — crash reports, page-load times, which features you clicked, your browser version and operating system. It's built into every major browser by default, and it's a separate system from the cookies and scripts that track you on individual websites: telemetry reports to the browser maker, not to the site you're visiting.

What browser telemetry collects

In its ordinary, intended form, telemetry covers performance and stability signals, not the content of what you're doing. This is the data browser makers use to prioritize bug fixes and decide which features are worth keeping:

• Performance metrics — page render times, JavaScript execution speed, memory usage
• Crash reports — what the browser was doing at the moment it crashed
• Feature usage — which menu items, settings, and extensions get used
• System information — OS version, screen resolution, hardware class
• Installation identifiers — a value tied to that specific browser install, used to de-duplicate reports across sessions

It's rarely just one system, either. Firefox's main telemetry pipeline is opt-out and covers interaction data broadly, but Mozilla also runs narrower, separate collectors for specific questions — the Firefox Default Browser Agent, for instance, is a Windows-only scheduled task that checks once a day whether Firefox is still the operating system's default browser, logging that result along with the OS locale and version. Mozilla is explicit that this specific data point is not linked to a user's regular profile telemetry — a small but real example of how "browser telemetry" is usually several independent collection systems bundled under one settings toggle, not a single pipe you can fully audit by reading one privacy policy paragraph.

Telemetry vs. tracking vs. analytics

Telemetry, web analytics, and third-party tracking all collect behavioral data, but they differ in who receives it and why:

• Telemetry — goes to the software vendor, about the software itself (crash rates, feature usage)
• Web analytics — goes to a site owner, about visitors to that specific site (Google Analytics, Plausible, and similar)
• Third-party tracking — goes to an advertising or data-broker network with no direct relationship to the user, built specifically to create a cross-site profile

The distinction holds up right until a vendor starts treating its own telemetry pipeline as a monetizable third-party asset — which is exactly what turns a diagnostic system into a tracking one.

The Avast/Jumpshot scandal

Avast's antivirus software and browser extensions marketed themselves explicitly as privacy tools — Avast's own download page told users to "reclaim your browser" and "shield your privacy" by blocking trackers. From 2014 to 2020, that same software collected users' detailed browsing history, search queries, and location lookups, and routed it through a subsidiary called Jumpshot, which sold it to more than 100 third parties, including advertising firms, investment companies, and data brokers.

The scale is what separates this from a garden-variety privacy-policy violation: the FTC's complaint found Jumpshot had amassed over 8 petabytes of browsing data from roughly 100 million devices, described internally as unlocking "walled garden data" no other provider could access. Avast's own anonymization process, the FTC found, wasn't sufficient — the data was sold as "detailed, re-identifiable browsing data," meaning buyers could combine it with other datasets to determine specific people's identities. Mozilla, Chrome, and Opera removed Avast's extensions from their stores in December 2019 after independent security researcher Wladimir Palant flagged them as functioning like spyware. The FTC fined Avast $16.5 million in February 2024 and permanently banned the company from selling browsing data for advertising purposes.

Microsoft Office's telemetry problem

The assumption behind most telemetry is that it stays at the metadata level — feature was clicked, page took 4 seconds to load — without touching actual document or communication content. A 2018 investigation by the Dutch Ministry of Justice, using the firm Privacy Company, found that wasn't true of Microsoft Office's telemetry: diagnostic data sent to Microsoft included actual email subject lines and full sentences pulled from Word documents, triggered when a user ran spell-check or translation features, and stored on servers in the United States.

This followed a separate 2017 finding by the Dutch Data Protection Authority that Windows 10's telemetry system violated Dutch privacy law — the DPA noted that even documenting the lowest "Basic" level of Windows telemetry collection required a 31,000-word explanation, which is itself a useful data point about how large these systems actually are compared to what a settings toggle implies. Microsoft's Office telemetry issue moved to Ireland's Data Protection Commission for a formal GDPR review in 2019, since Ireland is Microsoft's lead EU regulator. The edge case worth remembering: features that seem purely functional — spell check, grammar suggestions, translation — often work by sending content to a server for processing, and that content transmission can get bundled into the same telemetry pipeline as ordinary crash reports.

Privacy-preserving telemetry

Telemetry can be designed so the vendor's own servers can't reconstruct individual behavior from the data, even in principle — that's a meaningfully different guarantee than "we promise not to look." Brave's telemetry system, called P3A (Privacy-Preserving Product Analytics), uses a randomized-response technique: each client adds a calibrated amount of statistical noise to its own report before sending it, so any single report is unreliable on its own, but the noise cancels out in aggregate across millions of users, leaving Brave with accurate population-level trends and no way to trace a data point back to one device.

Independent testing backs up the practical difference this makes. A 2020 study by Douglas Leith at Trinity College Dublin measured telemetry behavior across six major browsers on first launch and during regular use, and found Brave transmitted the least identifying data of the group — no persistent identifiers and no URL-level telemetry at all. Brave's telemetry is also opt-in by default, meaning a fresh install sends nothing until a user actively enables it, the inverse of the opt-out default most other browsers ship with.

Microsoft Edge's hardware identifier

Not every browser resets its telemetry identifier when you reinstall it. The same Leith study found that Microsoft Edge sends a hardware UUID — a value generated from the physical device — alongside its telemetry, rather than an identifier tied to the browser installation. A normal installation ID disappears when a user uninstalls and reinstalls the browser; a hardware UUID survives that reset, because it's derived from the machine, not the software.

BleepingComputer independently corroborated the finding, using a network-inspection tool to confirm every URL typed into Edge's address bar was sent to Microsoft and Bing services in real time. Leith described this as the point where Edge became "qualitatively" different from Chrome, Firefox, and Safari — those three, per the same study, at least reset their telemetry identifier on a clean reinstall. Yandex's browser was found to behave the same way, sending a hashed hardware serial number and MAC address, though it has negligible reach outside Russia and Eastern Europe.

Browser telemetry compared

Telemetry and GDPR

GDPR's data-minimization principle requires that any personal data collection be limited to what's actually necessary for a stated purpose — which puts the burden on the browser or software maker to justify why a given telemetry field needs to exist at all, not on the user to prove it's harmful. That's the actual legal hook in the Microsoft Office case: crash counts and feature-usage clicks plausibly serve a diagnostic purpose, but email subject lines and document sentences are much harder to justify as necessary for improving spell-check. Under GDPR, violations of this kind can carry penalties of up to 4% of a company's global annual turnover, though as of this writing the Microsoft Office telemetry matter remains under regulatory review rather than resolved with a public fine.

How to reduce browser telemetry

The main telemetry toggle lives in a different menu on every browser, and on Edge it isn't fully exposed as a toggle at all.

Firefox

1. Open Settings → Privacy & Security.
2. Scroll to "Firefox Data Collection and Use."
3. Uncheck "Allow Firefox to send technical and interaction data to Mozilla."
4. Also uncheck "Allow Firefox to send backlogged crash reports" and "install and run studies" — these are controlled separately from the main toggle.

This does not disable the Default Browser Agent task described above, since Mozilla treats it as a separate system; removing it requires disabling the task directly in Windows Task Scheduler rather than in Firefox's own settings.

Chrome

1. Open Settings → You and Google → Sync and Google services.
2. Turn off "Help improve Chrome's features and performance."
3. Under Privacy and security, turn off "Make searches and browsing better" and enhanced spell check — both send what you type to Google.

Chrome has no setting that removes telemetry entirely. For that, the option is a different build — Ungoogled Chromium — rather than a configuration change inside Chrome itself.

Microsoft Edge

1. Open Settings → Privacy, search, and services.
2. Under "Diagnostic data," turn off "optional diagnostic data" — this is the only category Microsoft exposes as optional in a standard consumer install.

The hardware UUID and required diagnostic data described above aren't controlled by this toggle. Enterprise deployments can block required diagnostic data through Group Policy or a registry key (DiagnosticData under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge), but that option isn't available on a standard consumer install — which is the practical reason to pick a different browser if this specific identifier concerns you.

Brave

No action is needed by default, since P3A ships opt-in rather than opt-out. To confirm it's off, or to opt in and help Brave's aggregate usage metrics:

1. Open Settings → Privacy and security.
2. Check the P3A / diagnostic-reporting toggle and set it to match your preference.

Hardened alternatives

LibreWolf removes telemetry, crash reporting, and Mozilla's remote-experiment system (Normandy) entirely at the build level, rather than leaving it as a setting an update could silently re-enable — useful if you'd rather not depend on a toggle staying in the position you left it.