Data collection limited to minimum necessary for stated functionality

GDPR Art. 5(1)(c) codifies data minimization as a legal obligation, not a guideline — collecting more data than your declared function requires is itself a violation. Chrome extensions that request history, cookies, or webRequest permissions for features that do not use them expand the blast radius of any future compromise and invite rejection from store reviewers performing permission audits. CCPA §1798.100 gives users the right to know what data is collected; collecting data not mentioned in your listing undermines that right and exposes you to regulatory action. Overpermissioned extensions are also a primary signal in automated Chrome Web Store policy enforcement.

Audit your manifest.json permissions against actual API call sites. Remove any permission without a matching chrome.* API call in your codebase:

// BEFORE — overpermissioned
"permissions": ["history", "cookies", "storage", "tabs", "webRequest"]

// AFTER — scoped to actual usage
"permissions": ["storage", "tabs"]

Also remove background telemetry not disclosed in your store listing:

// Remove if not disclosed in privacy policy
chrome.tabs.onActivated.addListener((info) => {
  analytics.track('tab_switched'); // DELETE
});

If you find permissions you intend to use later, remove them now and re-request when the feature ships.