User data usage is disclosed and justified
Why it matters
Chrome Web Store's user data policy (chrome-cws-user-data-policy) requires that any extension collecting data disclose what is collected and why. GDPR Article 5 adds a lawfulness requirement: processing personal data without transparent disclosure is a violation, not just a policy gap. An extension with tabs, cookies, or webRequest permissions can access sensitive browsing behavior; users have no visibility into whether that data leaves their device unless you explicitly document it. Undisclosed data collection is also a top source of negative store reviews and user complaints that trigger review team investigations.
Severity rationale
Medium because undisclosed data collection violates chrome-cws-user-data-policy and GDPR Art. 5, but the impact depends on whether sensitive data is actually transmitted.
Remediation
Document every data-access permission and state explicitly what data (if any) is collected and where it goes. Add a Data Usage section to your README.
## Data Usage
- **Tab titles and URLs** — Read locally to display your tabs. Never transmitted.
- **User preferences** — Stored in `chrome.storage.local`. Never sent to external servers.
This extension does not collect personal information or share data with third parties.
If you do transmit data, name the destination server and the legal basis (consent, legitimate interest, etc.). Match every disclosed item against the permissions in your manifest — undisclosed permissions are as bad as undisclosed data.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Chrome Web Store Readiness Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 5 — GDPR — Principles relating to processing of personal data (purpose limitation, transparency)
- external · chrome-cws-user-data-policy — Chrome Web Store — User Data Privacy Policy
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-store-readiness·automated