What part of "we have x million monthly users" is "a consumer’s personal information"? That's information about how many consumers you have, but it's not personal
Mozilla might be doing very sketchy things with your data, but it's also very plausible that they are doing a reasonable job at anonymization of data but in a way that is still technically classified as selling personal data (in aggregate form).
Per: https://thecpra.org/#1798.145(a)(6)
> Exemptions: > (6) Collect, use, retain, sell, share, or disclose consumers’ personal information that is deidentified or aggregate consumer information.
I understand that people who have a vested interest in eroding any possibility of online privacy and data protection would want us to believe these laws are vague and overreaching - but that doesn’t mean they actually are vague and overreaching.