MAC and IP should specifically be listed "Personal Information" for all interactions in your Privacy Policy

Question

Except for those who run cute lil' programs that could disorient or disrupt the system, possessing someone's MAC is possessing the 'true name' of at least one portion of their computer. Follow the computer in your accumulated files, and somewhere, this note even, gives you the mailing address, and a good lead on who owner is. IP address, if too static, well, same deal. With policy in place, I can feel free to run a server AND the rest of my system on the same fiber broadband line, saving me enough $/yr to buy an upgrade or two.
Let's face it, YOU are your equipment, and if I wanted to use my name, I would.

Answer 1

First, if you keep up a file until you can match a firewall MAC with doc with a name on it, the rest is fairly simple. Traceroute the IP, and, while NOT as easy as a return address sticker, it is a pretty easy thing to do. Mozilla admits this:
Any information that can connect even a firewall with a place or individual(s)should be defined strictly as "personal information in a privacy policy, period.
I worry about the Eternal Word, especially the records kept by suppliers of everything, including Mozilla, which, without paperwork like a subpoena or warrant,
"may share potentially-personally identifying information with its employees, contractors, service providers, and subsidiaries and related organizations. ..." Otherwise, Mozilla will not publicly release potentially-personally identifying information except under the same circumstances as Mozilla releases personally identifying information. Those circumstances are explained below, the Four Reasons Mozilla may release to companies including Google's Doubleclick Division, which crows, in privacy statements about a)getting access to all of Google's raw data, b) crunching and mashing for best web ad placement - NOT for "people like YOU" but Only for YOU the wife of Bradbury's Fireman is told, as she awaits a once-in-lifetime chance to influence the flow of a 3V soap opera..
Here's one Mozilla protection against releasing information to the PUBLIC, private industry and the governments of the world:
First, in admitting what you said above is not the case:,
"... Mozilla also collects potentially-personally identifying information like Internet Protocol (IP) addresses, which are non-personally identifying in and of themselves but could be used in conjunction with other information to personally identify users"
What does it do with these records, which I would prefer have every identification mark removed the microsecond it arrives?
Well, if you are not in business with Mozilla, just another user:
"1. Mozilla does not publicly release information gathered in connection with commercial transactions (i.e., transactions involving money), including transactions conducted through the Mozilla Foundation Store or donations to the Mozilla Foundation.
2. Mozilla does not publicly release personally identifying information collected in connection with an application for employment with Mozilla.
3. Mozilla does not make publicly available information that is used to authenticate users the publication of which would compromise the security of Mozilla's websites (e.g., passwords).
4. Mozilla does not make publicly available information that it specifically promises at the time of collection to maintain in confidence."
Part 1 is UNTRUE to the extent that Mozilla reports and/or verifies donations, either the 5 largest or everyone donating more than I think it's $30K for the annual Form IRS 990, a NfP's equivalent of a Form 1040 - the last three are generally posted on the foundation site.
Part 2 is The Law in most states.
Part 3 promises internal security to Mozilla, and says NOTHING about users.
Part 4 avoids nasty suits.
And the list is followed by a curious statement: "Outside those four contexts, users should assume that personally identifying information provided through Mozilla's websites will be made available to the public."
What about PRIVATE transactions (purchases, trades, 'aid in kind') - curiously missing is any statement? Or 'requests' from public and private guys in suits?
Ominously, for those who regard the rapid collection of data from social networking 'harmless' or 'fun', "Mozilla may interact with you through social networks to further our mission. When you interact with us at a third-party social network, such as Facebook, Twitter, or Google +, the network gives us the ability to access and store certain information from your profile for that social network.
Like the guy who posted a copy of an ad he found for hospital lubricant in 55-gallon drums - and found himself the Facebook spokesman for a KY-Jelly-type product.
"Consistent with our privacy commitments, we will scrutinize third party requests for information about YOU for compliance with the law, including those coming from governmental agencies or civil litigants. We may access, use, preserve or disclose information about you only WHEN WE HAVE A GOOD FAITH BELIEF that it is REASONABLY necessary to do so to satisfy the applicable law, regulation, legal process or LAWFUL GOVERNMENT REQUEST OF ANY COUNTRY, or to protect the rights, property or safety of Mozilla, its users or the public. We will provide notice of legal process or governmental requests unless prohibited to do so by law or the circumstances warrant otherwise."[emphases added, words a direct quote.] Good Faith in legality of actionswas Nixon's initial excuse too - for setting up the Plumbers unit.
I would prefer a statement like:
'Mozilla Foundation and its subdivisions are committed to neither selling, trading, supplying, borrowing or using any data that can possibly be linked to a given user or volunteer.
We will fight tooth and claw on behalf of our users and participants - to resist ANY attempt by any agency, public or private, for ANY reason, including promises of money or advertising, to divulge ANY information about them to anyone, PARTICULARLY when the request comes from a government with a less-than-stellar civil/judicial rights record, according to agencies like Human Rights Watch, the European Union's human rights division, the Permanent Court of International Justice division dealing with mass murderers and the like.
We will fight as strongly against US, State or local government agency requests for information. We will place the people we work so hard to serve above ourselves, and be dragged kicking and screaming all the way to the courthouse door, with as many live net feeds and calls to the traditional public media as possible. And we will barricade any door if we fear a midnight knock.
We will provide governments outside the countries where we do business (list here) with nothing unless ordered to by US courts, at least after fighting as many rounds of appeals as we are allowed, and will publicly and politically battle any agency which attempts to get user/participant data from us. All Foundation AND subsidiary employees earning more than $150,000 a year have pledged a minimum of 10% of their salary to these battles, if needed.
We further put agencies, public and private, on notice that we maintain as little data as possible on our free and paying customers, and do not maintain a single record we are not required to keep, even if it makes our business a bit more difficult to perform.
And if we get word someone might be coming, they're liable to find all computers free of data, which, if legally possible - before a subpoena or warrant arrives, just on rumor it is coming, we will destroy everything - to the point of installing and activating scuttling devices on all disks and backups, no matter where stored. We take this protection very seriously, and would rather face a business and directory rebuild than give any information that could locate a product user.'
I'd rather like to see a statement like this as part of the Privacy Policy of every IT-related corporation in the world - though I doubt even Mozilla has the nerve or commitment to its manifesto. We wont ever see anything like it - when asked by the local Homeland Security-style division, for info on a dozen or, for that matter, all users, it is CYA time around the world.
Smith 1 is in 1984, Smith 2 is a great San Francisco xerography artist. Smiths 3,4,5,6,7 have been spotted on the net. Use the name, it is a good name to let Big Google know how you feel.