- Outcome
- Consistent privacy evidence
- Store lens
- Chrome and Microsoft Edge
- Reading time
- 12 minutes
Map the real data flow
Inventory collection at extension pages, content scripts, background workers, native helpers, APIs, analytics, crash reporting, authentication, and payments. Record destination, purpose, retention, access, and deletion.
Include data the extension can read and data it actually transmits. Browser access does not automatically mean collection, but undisclosed transmission is a serious mismatch.
Make every surface agree
Compare the code-derived inventory with the privacy policy, store privacy form, listing, onboarding, and prominent disclosure. Resolve contradictions before submission.
Chrome's July 2026 update states that all collection must be prominently disclosed and post-install data-handling changes proactively disclosed. Microsoft also requires accurate disclosures and secure handling under its developer policies.
Synthetic example
Synthetic mismatch
Code evidence: POST { pageUrl, selectedText } to api.example.test
Store answer: "This extension does not collect website content"
Action: stop transmission or correct the disclosure, purpose, and consent flow
Review necessity, consent, and vendors
Tie each data element to the disclosed single purpose. Remove speculative collection. Put sensitive disclosure where the user will see it before collection, not only in a distant policy.
Document processors, cross-border handling, security controls, retention, account deletion, support contact, and whether data is sold or used for advertising or credit decisions.
Test the promise
Use a clean profile and network inspection to test install, primary features, analytics, error paths, sign-out, and uninstall. Confirm that denied consent and revoked permissions actually stop the relevant flow.
Repeat this review whenever endpoints, SDKs, permissions, or product purpose change. A static scan cannot see backend retention or prove that a written policy matches production.
Do not send ExtensionGate or a support mailbox your extension package, source code, credentials, keys, or customer data when reporting a security issue.
Official sources
- Chrome Web Store user data policy
- Chrome Web Store policy updates for 2026
- Microsoft Edge extension developer policies
- Microsoft Edge publishing privacy fields
Sources and guidance were human-reviewed on . Store forms and policies can change; verify them again at submission time.