I don’t care if that information is not potentially identifying information; all I care about is if I’m being tracked in any way.

Again, my feelings on this is particular to Mozilla – with Google or Omniture, I can expect to be tracked and respond accordingly (by blocking access or other local means). My problem was merely that Mozilla is doing things that are against its expressed value system.

As far as the data in the logs that were used to generate this analysis, it is important to consider that, other than the IP address, there is no potentially identifying information (PII), and we are not building a user profile or compiling usage on a user basis to track the activity or choices of a user over time. I believe that, since we are doing none of those user tracking things, the analysis that we are doing with this data falls well outside what most people expect to be protected from when they turn DNT on.

There are two possible threats that we were looking to solve and one non-threat:
1. Data theft — If someone managed a break in and they could download the TBs of data, we want to make it as difficult as is reasonably possible to prevent them from seeing IPs.
2. Data acquisition — If Mozilla were subpoenaed or otherwise required to hand over any available data about a particular IP address, we would like to have as little capability and liability to do that as is reasonable.
x. Data misuse — Any reasonably implemented strategy should prevent misuse by Mozilla itself, including the potential for a change of policy that would open up old data to be used in ways that were not originally planned.

The hashing strategy is likely to have handled all three of these concerns, but as I mentioned above, it turned out to be safer and simpler to avoid using hashing at all.

@Wladimir — Setting aside rainbow tables, the hashing strategy that was originally described was specifically designed to prevent the ability to look up a particular IP address. If you salt the hash with a good random salt that is generated every day and is *not* kept around after that day is passed, then you would not be able to do a lookup the way you describe.

Is ‘anonymised’ data also deleted after 6 months?

Anyway it’s interesting to see the ~linear increase in adoption after the pref was exposed in the menus. I feel like we should do that more often. There’s so many handy features of Fx that are relegated to the ‘about:config’ tab which I’m sure people would use if they knew the features existed.