Background scripts do not persistently log full browsing history

A background script that persistently logs visited URLs to chrome.storage.local or an external server is, functionally, spyware — regardless of intent. GDPR Art. 5(1)(c) prohibits collecting data beyond what is necessary; Art. 5(1)(e) requires data not be retained longer than needed. Persistent browsing history in extension storage becomes a high-value target: a single compromise of the extension or its backend server exposes a complete record of the user's online behavior. The Chrome Web Store User Data Policy explicitly prohibits collecting user activity beyond declared core functionality, and violations result in immediate delisting.

Replace persistent storage writes inside tab listeners with in-memory state that clears on extension unload:

// GOOD — memory only, no persistent history log
let currentTabUrl = null;

chrome.tabs.onActivated.addListener(({ tabId }) => {
  chrome.tabs.get(tabId, (tab) => {
    currentTabUrl = tab.url; // Used in-session only, not persisted
  });
});

If your feature genuinely requires storing activity (e.g., a user-controlled history tool), make it explicit: get consent first per pii-consent, encrypt the data per local-pii-encrypted, and document the retention period per retention-periods. Never write URL data to storage inside a tab event handler without those three controls in place.