Policy explicitly states whether data is sold or shared with third parties
Why it matters
GDPR Art. 13(1)(e) requires explicit disclosure of any recipients or categories of recipients of personal data before collection. CCPA §1798.115 gives users the right to know whether their data is sold or shared. An extension that sends user data to Google Analytics, Sentry, or a custom analytics backend without disclosing this in its privacy policy is in direct violation of both regulations — and of Chrome Web Store policy, which requires accurate data sharing disclosures in the store listing. Users who install an extension believing it processes data locally have a reasonable expectation that has been violated if data is silently leaving their device.
Severity rationale
High because undisclosed third-party data sharing is a standalone GDPR and CCPA violation — regulators treat silent data transmission to unnamed third parties as evidence of bad faith, warranting investigation and fines independent of any data breach.
Remediation
Add a "Third-Party Services" section to your PRIVACY.md or hosted privacy policy, naming every external service your extension contacts:
## Third-Party Services
This extension sends anonymized usage data to:
- **Sentry** (error tracking): https://sentry.io/privacy/
- **Google Analytics** (usage statistics): https://policies.google.com/privacy
We do NOT sell user data to any third party.
Also update the Chrome Web Store listing's "Privacy practices" section to reflect each third party named above. If a service is used only during development (e.g., a local error logger), confirm it is disabled in production builds before shipping.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Extension Data Privacy Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13(1)(e) — Recipients or categories of recipients of personal data
- ccpa · §1798.115 — Right to know about disclosure of personal information to third parties
- external · chrome-web-store-user-data-policy — Chrome Web Store User Data Privacy Policy — Disclosure of third-party data sharing
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-data-privacy·automated