Explicit user consent obtained before collecting any PII

Chrome extensions operate inside the browser with elevated trust, making them a uniquely dangerous collection point for PII. Collecting names, emails, or browsing patterns without explicit opt-in consent violates GDPR Art. 6 and Art. 7, CCPA §1798.100, and the Chrome Web Store User Data Policy — each of which requires a lawful basis before processing. CWE-359 captures the failure mode precisely: exposing private information without authorization. Beyond compliance, extensions that silently harvest PII expose users to identity theft and damage developer reputation irreparably if discovered by a store reviewer or security researcher.

Gate every PII collection call behind a stored consent flag. Add an explicit opt-in toggle to your options page before any data leaves the device:

<label>
  <input type="checkbox" id="enableTracking" />
  Allow anonymous usage statistics to improve this extension
</label>

Then in your background script, read the flag before sending:

chrome.storage.local.get(['consentGiven'], ({ consentGiven }) => {
  if (consentGiven) {
    sendAnalytics(data);
  }
});

Default the flag to false (opt-in, not opt-out) so unconfigured installs never transmit PII.