Privacy Policy URL is valid and publicly accessible
Why it matters
Chrome Web Store requires a privacy policy for any extension that handles user data, and GDPR Article 13 mandates disclosure of data collection at the point of data gathering. A broken or missing privacy policy URL causes store rejection. Beyond compliance, a placeholder policy ("To be determined") exposes you to regulatory action in the EU and UK — regulators treat a published placeholder as a misrepresentation, not an absence. Users who can't find your privacy policy are far more likely to uninstall or leave negative reviews flagging trust concerns.
Severity rationale
Critical because a missing or broken privacy policy causes Chrome Web Store rejection and creates GDPR Article 13 compliance exposure for EU users.
Remediation
Publish a real privacy policy at a stable URL and reference it in manifest.json. A minimal honest policy is better than a detailed placeholder.
{
"homepage_url": "https://yoursite.com/privacy"
}
Minimum content required in the policy:
# Privacy Policy
This extension does not collect personal data. User preferences are stored locally in browser storage and are never transmitted to external servers.
If you do collect data, disclose what, why, and the legal basis (GDPR Art. 6). Test the URL returns HTTP 200 before submitting to the store.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Chrome Web Store Readiness Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13 — GDPR — Information to be provided where personal data are collected from the data subject
- external · chrome-cws-privacy-policy — Chrome Web Store — Privacy Policy Requirement
- gdpr · Art. 6 — Lawfulness of processing
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-store-readiness·automated