Mozilla's add-on policies require reviewable code, ban obfuscation and remote code execution, limit data transmission to what is necessary, and require opt in before personal data is sent. Add-ons that break the rules can be rejected or blocked. The policies reduce risk but do not replace your own judgment.
What the policies say
Reviewable code. Code must be provided in a way that Mozilla can review. Mozilla reviews code before transpiling or minification and may ask authors to refactor code that is hard to review. Minification for file size is allowed.
No obfuscation. Add-ons may not contain obfuscated code or code that hides the purpose of its functionality.
No remote code. Add-ons must be self contained and must not load remote code for execution. They also cannot load or redirect to a remote new tab page, or weaken web page security headers such as Content Security Policy.
Data rules
The policy text says add-ons must limit data transmission to what is necessary for functionality, and use it only for the purpose it was sent for. Users need a clear way to control data transmission, through the add-on's own consent experience or Firefox's built in one.
Two tiers apply:
- Personal information requires explicit opt in. The add-on has to describe it first.
- Technical and interaction data is opt out. Users must be able to disable it, and the add-on cannot be restricted if they decline.
Add-ons targeting Firefox 140 or later that use the built in consent experience must accurately declare their data practices in the manifest.
Enforcement
Add-ons must behave as described. Review includes basic functional testing as well as code review. Mozilla may reject or block versions or entire add-ons, and may act immediately where violations look intentional or repeated.
What this does not give you
A policy is a promise by the publisher, checked by sampling and by reports. It cannot see everything. Some points to keep in mind:
- Passing review at one point does not mean a later update is safe.
- Broad permissions are still broad. Read what the add-on asks for.
- A consent screen tells you what data goes out, but you still choose whether to accept.
For permission syntax and meaning, see match patterns explained. For Mozilla's own permission types, MDN lists host permissions, API permissions and activeTab, with optional permissions requested at runtime.
A short routine for Firefox
- Install only from addons.mozilla.org unless you have a clear reason.
- Read the permissions prompt.
- Check the privacy and data collection details on the listing.
- Remove add-ons you no longer use.
Quick check
Does Mozilla review every add-on?
The policies state that add-ons undergo code review and basic functional testing, and that Mozilla can reject or block them. This post does not cover the exact review process, so check Mozilla's review documentation for details.
Is minified code a red flag?
No. Minification is permitted. Obfuscation is the prohibited practice.
Sources
Last reviewed: 19 October 2026.
