By that definition, wouldn’t sharing total monthly users for the basic purpose of landing some kind of deal (could be as simple as a partnership), constitute “selling data”? Stats like X million monthly users doesn’t appear to conflict with the spirit of the claim, but does conflict with that legal wording.
What part of "we have x million monthly users" is "a consumer’s personal information"? That's information about how many consumers you have, but it's not personal
But, "we have x million monthly users _in Arizona_" would be using your personal data, from a legal standpoint. And if they provide that aggregate data in exchange for money, they are selling your personal data (but not in the way many people think of it, like in a Google/FB sense of building an individualized profile and selling ads against that).
Mozilla might be doing very sketchy things with your data, but it's also very plausible that they are doing a reasonable job at anonymization of data but in a way that is still technically classified as selling personal data (in aggregate form).
> Exemptions:
> (6) Collect, use, retain, sell, share, or disclose consumers’ personal information that is deidentified or aggregate consumer information.
I understand that people who have a vested interest in eroding any possibility of online privacy and data protection would want us to believe these laws are vague and overreaching - but that doesn’t mean they actually are vague and overreaching.
