Contact mechanism provided for privacy-related inquiries
Why it matters
GDPR Art. 13(1)(a) requires the data controller's contact details to be provided to users. GDPR Art. 77 gives users the right to lodge a complaint with a supervisory authority if their privacy concerns are not addressed — that right is meaningless without a contact mechanism for raising concerns first. CCPA §1798.130 requires businesses to designate at least two means for consumers to submit data rights requests. Chrome Web Store policy also requires developers to be contactable about their data practices. An extension with no privacy contact forces users with legitimate concerns directly to regulatory complaints or store reviews, both of which damage the developer's standing.
Severity rationale
Low because a missing privacy contact is a regulatory compliance gap under GDPR Art. 13 and CCPA §1798.130 — it does not expose data directly but removes users' only non-regulatory avenue for exercising their data rights.
Remediation
Add a privacy contact to your options.html and your privacy policy. In the UI:
<!-- In options.html -->
<footer>
<p>Privacy questions? Contact us:
<a href="mailto:privacy@example.com">privacy@example.com</a>
</p>
</footer>
In PRIVACY.md:
## Contact Us
For questions about your data or to request deletion, email:
privacy@example.com
We respond to privacy requests within 30 days.
Use a dedicated privacy email address rather than a general support alias — it signals that privacy requests are handled separately and seriously, and makes GDPR Art. 17 deletion requests easier to track.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Extension Data Privacy Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13(1)(a) — Identity and contact details of the controller
- gdpr · Art. 77 — Right to lodge a complaint — requires controller contact info
- ccpa · §1798.130 — Methods for submitting consumer requests
- external · chrome-web-store-user-data-policy — Chrome Web Store User Data Privacy Policy — Contact info required for privacy inquiries
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-data-privacy·automated