Mozilla's Firefox 149, released on 24 March 2026, includes a free built-in VPN. Users signed into a Mozilla account can route their browser traffic through a Mozilla-operated proxy for up to 50GB a month. It's a privacy feature for users, but web developers should notice it too: a large browser now sends a share of its users through shared proxy IPs, which affects geolocation, rate limiting and fraud scoring.
What happened
The feature started a progressive rollout with Firefox 149, beginning with users in the United States, United Kingdom, Germany and France. Mozilla hasn't given a timeline for other regions, and some users in eligible countries reported not seeing it right after updating. How it works:
- Sign in and toggle. Users sign into a Mozilla account, and a toolbar control turns the VPN on or off.
- Browser traffic only. It hides the user's IP address and apparent location for Firefox traffic. Other apps and system connections aren't covered. Mozilla's paid Mozilla VPN remains the device-wide option.
- 50GB per month, with in-browser warnings as the limit gets closer.
- Per-site exceptions. Users can exclude up to five sites from the proxy. Some services are always excluded, such as account authentication and public Wi-Fi captive portals, so logins and reconnection keep working.
- Server location. BleepingComputer reports the server is chosen for location and performance and is based in the US.
Mozilla says it collects only limited technical and interaction data, such as whether a connection succeeded and daily data use. It says it doesn't log browsing activity or the contents of communications. Firefox 149 also added Split View for side-by-side tabs, automatically blocks notifications from sites flagged by Safe Browsing, and fixed 46 security issues, more than half rated high severity.
Who is affected
- Firefox users in the four launch countries who sign into a Mozilla account.
- Web applications that infer location from IP addresses, apply per-IP rate limits, or score sign-ups and payments by IP reputation.
- QA and support teams who will see "wrong country" reports from users who left the toggle on.
What it means for developers and engineering teams
Browser-integrated proxies are becoming normal. Apple's iCloud Private Relay, the VPNs some browsers include, and now Firefox's VPN all put ordinary users behind shared egress IPs. That affects several common patterns:
- IP geolocation is not user location. A user in Berlin may appear to be in the US. Use the
Accept-Languageheader, account settings or explicit user choice for locale and currency, and treat IP geolocation as a weak hint. - Per-IP rate limits hit innocent users. Many people share one proxy egress IP, so strict per-IP thresholds will throttle real users. Rate-limit per session, account or API key instead, or raise per-IP limits for known proxy ranges.
- Proxy equals fraud is out of date. Fraud rules that heavily penalize VPN or proxy IPs will add friction for privacy-conscious but legitimate users. Combine IP signals with device, behavior and account history.
- Geo-restricted features such as content licensing, regional pricing and compliance gating will misfire for these users. Show a clear message, not a silent failure.
For developers it's also a free, quick way to check how your site behaves from a different IP. It isn't a replacement for proper geo-testing infrastructure, because the egress location isn't under your control.
What to do now
- Audit IP-based logic in your app: geolocation, rate limiting, fraud scores and geo-blocking. List what breaks when many users share an IP.
- Prefer user-declared locale and
Accept-Languageover IP for language, currency and content defaults. - Key rate limits on authenticated identity or session where possible, and keep per-IP limits as a coarse backstop.
- Review fraud rules that block on proxy or VPN detection alone, and add step-up verification instead of hard blocks.
- Update support macros so agents ask users to try disabling the Firefox VPN when location-related issues come in.
- Update Firefox to 149 or later for the 46 security fixes, whether or not you use the VPN.