Safeguard
Supply Chain•

An approved extension changes owner: what does store policy cover?

Chrome Web Store policy has no dedicated rule on extension ownership transfers, only a consent rule on sharing data in a sale. Here is how to watch for it.

Safeguard Security Team
3 min read

Chrome Web Store program policies have no dedicated section on transferring ownership of an extension. The closest text is in the Limited Use rules, which allow user data to be shared in a merger, acquisition or sale of assets only after explicit prior consent from the user. So your own monitoring has to catch an owner change.

What we found in the policy text

We read the Chrome Web Store program policies for rules on ownership changes. There is no section on the topic. Related rules still apply to whoever owns the listing:

  • Extensions may only collect, use or transmit user data necessary for the disclosed single purpose, and other transfers, uses or sale of user data are prohibited.
  • Collection and use of web browsing activity is prohibited under the Limited Use section.
  • User data may be shared as part of a merger, acquisition or sale of assets of the developer after obtaining explicit prior consent from the user.
  • The policies also state that Google may update them at any time.

We are not drawing a conclusion about any specific transfer. The point for an admin is narrower: the store does not promise to tell you, or your users, when a publisher changes.

Why admins care

You approved an extension based on its publisher, its history and its permissions. If the publisher changes, much of that reasoning no longer holds. The code may be the same on day one and different on day thirty. For that reason a change of publisher should reopen the review.

Signals to watch

SignalWhere to look
Publisher or developer name changesThe store listing
New support or privacy policy addressThe listing and linked policy
New permissions in an updateThe extension's manifest after update
Sudden change in listing style or languageThe listing
New network destinationsA test machine with traffic logging

None of these proves anything alone. Several together justify a re-review.

A re-review routine

  1. Keep a snapshot of the listing at approval time: publisher, privacy policy, permissions and version.
  2. Check each approved extension monthly against the snapshot, or sooner for high-risk ones.
  3. If the publisher changed, move the extension to a hold state: restrict it to a pilot group or block it pending review.
  4. Re-read the permissions and privacy policy, and compare network behavior to the last review.
  5. Record the outcome and the date.

Our update adds a permission post covers what Chrome does when permissions grow.

Contract and procurement angle

If a vendor ships a company extension, ask in the contract or questionnaire to be told about changes of ownership and about changes to subprocessors. This is a procurement question, not legal advice, so take your own counsel on wording.

Quick check

Does the Chrome Web Store notify users when an extension is sold?

We found no such rule in the program policies we read. Treat notification as something you must detect yourself.

Is a changed publisher always a problem?

No. Companies are legitimately acquired. It is a reason to re-review, not a verdict.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.