Chrome Web Store policy requires an extension that handles user data to link an accurate, current privacy policy in the Developer Dashboard, collect only what its disclosed single purpose needs, follow Limited Use rules on transfers and human access, obtain affirmative consent before installation, and transmit data with modern cryptography.
The requirements in plain words
From the program policies:
- Privacy policy. Accurate and up to date, linked in the Developer Dashboard, disclosing collection, use, sharing and all parties receiving data.
- Minimum data. Collection limited to what is necessary for the disclosed single purpose.
- Browsing activity. Prohibited except for user-facing features that are prominently described.
- Limited Use. Restrictions on transfers to third parties, human access to data, and use for personalised ads, data sales, or creditworthiness and lending decisions. A public website must affirmatively state that data use complies.
- Disclosure and consent. Data practices prominently disclosed, with affirmative consent before installation. Changes after installation must be disclosed too.
- Security. Data transmitted securely using modern cryptography.
- Permissions. The narrowest permissions needed. Requesting permissions for future features that do not exist yet is not allowed.
What this lets a reviewer ask
| Question | Policy basis |
|---|---|
| What is the single purpose? | Collection must match it |
| Does it read browsing activity? | Prohibited unless a prominent user-facing feature |
| Who receives the data? | Privacy policy must list all parties |
| Is any data sold or used for ads? | Limited Use restrictions |
| Is it encrypted in transit? | Modern cryptography required |
| Why this permission? | Narrowest necessary permissions |
A buyer's approach
- Open the store listing and read the privacy practices disclosure.
- Open the linked privacy policy. Does it name recipients?
- Compare requested permissions with the feature list.
- Test on a clean profile and watch network destinations.
- Record the answers with the extension version and date.
If the policy is generic and the permissions are broad, ask the publisher to explain before approving. If you cannot get a clear answer, that is your answer.
A publisher's approach
- Write the single purpose in one sentence and keep every feature under it.
- Keep the privacy policy synchronised with releases. Policy drift is a common reason for warnings.
- Prefer optional permissions that ask at the time of use.
- Do not collect data just in case it becomes useful.
- If you add a data flow, disclose it before shipping the update, not after.
Why the rules matter for security
Data an extension never collects cannot be stolen from it, sold by an acquirer, or leaked in its backend. The single purpose rule and permission minimum are security controls as much as privacy ones. They shrink what an attacker gets by compromising the publisher account or the update channel.
That is also why ownership changes are risky: a new owner inherits access and a data flow, and may change both. Watch publisher changes for extensions that handle sensitive data.
Safeguard's compliance and evidence automation can keep the approval records, and dependency scanning covers what the extension itself bundles.
Quick check
Is collecting browsing history allowed?
Collecting web browsing activity is prohibited except for user-facing features that are prominently described.
Can a developer ask for permissions for a future feature?
No. The policy says requesting permissions for future features that do not yet exist is not allowed.
Do consent and disclosure apply after install?
Yes. Post-installation changes to data practices must also be disclosed.
Sources
Last reviewed: 19 October 2026.
