Chrome Web Store requiring developers to disclose what data extensions collect

Over the past few years, Google has been continuously working to make Chrome extensions safer. Developers now have to limit what they do with collected data, while the Chrome Web Store early next year will feature a privacy practices disclosure .

Starting in January, every extension on the Chrome Web Store will list “in clear and easy to understand language” what data it collects. Categories include personally identifying, health, financial/payment, and authentication information, as well as location, web history, user activity, and website content.

These privacy disclosures are self-reported, with the developer dashboard’s privacy section featuring a new form that must be filled before publishing or updating an extension.

The disclosure form is grouped by category to make it simpler for developers, and maps exactly to the disclosures that will be displayed to Chrome users. Most of this information will be consistent with existing privacy policies that developers have provided to the Chrome Web Store. 

Google is also requiring extension developers to limit how they use collected data:

• Ensuring the use or transfer of user data is for the primary benefit of the user and in accordance with the stated purpose of the extension.
• Reiterating that the sale of user data is never allowed. Google does not sell user data and extension developers may not do this either.
• Prohibiting the use or transfer of user data for personalized advertising. 
• Prohibiting the use or transfer of user data for creditworthiness or any form of lending qualification and to data brokers or other information resellers. 

Developers have to certify that they do not:

• Sell user data to third parties
• Use or transfer user data for purposes that are unrelated to my item’s single purpose
• Use or transfer user data to determine creditworthiness or for lending purposes

The Chrome Web Store will start displaying this disclosure on January 18, 2021, with Google putting the following notice on extensions that have not certified their compliance with the Limited Use policy.