I was adding a secondary email address to my Firefox Account, it happened that I mistyped one letter. Now Firefox sent the confirmation code to that person with the details of my primary E-Mail address, my IP Address and my location. It was my mistake. Now, it's obvious that a confirmation code is needed because such scenarios could happen. If it was me who sent the code, then I would already recognize it was me. If someone sent a code to my email by mistake, why expose their specific IP to me? "If you received it by mistake, you don’t need to do anything." combined with exposing IP address doesn't make any sense for a privacy-oriented browser. That's why confirmation codes are sent in the first place, to confirm the right person has access?