Chrome extension pre-submission checklist

Outcome: A review-ready Chrome submission
Store lens: Chrome Web Store
Reading time: 11 minutes

Scope:This checklist reduces avoidable submission risk. It is not legal advice, does not replace hands-on testing, and cannot guarantee approval.

1. Freeze the package you will submit

Review the exact ZIP that will be uploaded, not a development folder. Confirm that manifest.json is at the archive root and every referenced script, icon, page, and content resource exists with matching capitalization.

Build from a clean revision and record the commit, package hash, version, and build command. A reviewer should be able to connect the listing and privacy answers to this exact artifact.

Remove source maps, test credentials, private keys, unused permissions, and development-only hosts.
Load the unpacked build in a clean Chrome profile and exercise install, update, primary purpose, options, and uninstall.
Test signed-out, empty-state, offline, and denied-permission paths where applicable.

2. Reconcile code, permissions, and purpose

Write one plain-language sentence describing the extension's single purpose. Every requested permission and host pattern should have a concrete feature-level reason that supports that purpose.

Prefer narrower hosts, optional permissions, and activeTab when they truly meet the feature need. Do not remove a permission merely to satisfy a scanner if the extension genuinely requires it; document the necessity instead.

Synthetic example

                Synthetic permission inventory
activeTab  -> user-clicked page capture
storage    -> locally saved preferences
https://api.example.test/* -> sync endpoint used after sign-in

3. Reconcile collection and disclosures

Trace data from collection through transmission, storage, sharing, and deletion. The privacy policy, prominent in-product disclosure, Chrome privacy form, and actual behavior should agree.

Chrome announced that beginning August 1, 2026, all data collection must be prominently disclosed, collected data must be necessary for the disclosed purpose, and relevant data-handling changes must be disclosed after installation.

List data actually transmitted, including URLs, page content, identifiers, diagnostics, and authentication data.
Explain retention, deletion, encryption in transit, service providers, and whether data is sold or used for unrelated purposes.
Make consent contextual and understandable before sensitive collection begins.

Policy publication and enforcement dates are different: Chrome published the 2026 update on July 1 and stated enforcement begins August 1.

4. Prepare the reviewer path

Make the listing accurate and complete. Provide test credentials and certification notes when functionality is gated, describe setup, and ensure the reviewer can reach the primary feature without guessing.

Take final screenshots of the listing, privacy answers, permission justifications, and uploaded version. If the store raises an issue, respond to the exact policy language and changed evidence rather than resubmitting blindly.

Official sources

Sources and guidance were human-reviewed on 2026-07-29. Store forms and policies can change; verify them again at submission time.

Related ExtensionGate pages

Run a private preflight All guides