# Chrome extension privacy policy requirements > Chrome Web Store requires an accurate privacy policy for extensions that handle user data, a dashboard link, and a Limited Use disclosure. If a Chrome extension handles any user data, the Chrome Web Store requires an accurate, up-to-date privacy policy that explains how the extension collects, uses, and shares that data and names all parties it is shared with. The link goes in the designated field of the Chrome Web Store Developer Dashboard. The Limited Use policy additionally restricts data use to the extension's single disclosed purpose and requires a public statement on a website belonging to the extension. Canonical URL: https://legalpolicygenerator.com/resources/chrome-extension-privacy-policy ## When a policy is required The Chrome Web Store user data policy states that if your product handles any user data, you must post an accurate and up-to-date privacy policy. User data is interpreted broadly: browsing history, page content, form input, authentication details, location, personal communications, and website content the extension reads all count. Extensions with host permissions for all sites, content scripts that read pages, or network interception almost always handle user data, even if nothing is sent to a server. ## What the policy must say The policy must disclose how the extension collects, uses, and shares user data, and all parties the user data will be shared with. Be specific about what is processed locally in the browser and what leaves the device, which servers or APIs receive it, and why. If the extension syncs settings, calls an AI model, sends analytics, or reports errors, those flows and providers belong in the policy. ## Where to link it The policy is provided by adding its link in the designated Chrome Web Store Developer Dashboard field. The dashboard's privacy practices section also asks you to declare the extension's single purpose, justify each permission, list the data types handled, and certify compliance with the developer program policies. The linked policy, the dashboard declarations, and the extension's behavior must agree. ## The Limited Use requirements The Limited Use policy allows user data to be used only as necessary for the extension's disclosed single purpose, or to improve user-facing features prominently described in the listing. It prohibits transferring or selling user data to third parties such as advertising platforms, data brokers, or other information resellers, using it for personalized advertising, and using it to determine creditworthiness or for lending purposes, and it limits human access. The disclosure of Limited Use compliance must be made on a website belonging to your extension, for example through a link on the homepage to a dedicated page or to the privacy policy. ## Prominent disclosure and consent Where an extension collects personal or sensitive user data that is not closely related to functionality described prominently in the listing and user interface, the user data policy requires a prominent disclosure and affirmative consent before collection. Keep the in-extension disclosure and the privacy policy consistent, and do not collect data before the user agrees. ## Security and minimal permissions The policy expects user data to be handled securely, including transmission with modern cryptography. Request only the permissions the single purpose needs; broad host permissions invite review scrutiny and should be justified in the dashboard and explained in plain language in the policy. ## Extensions that use Google sign-in or APIs If the extension requests Google OAuth scopes, for example to read Gmail or Drive, it must also meet the Google API Services User Data Policy and OAuth verification rules, which have their own privacy policy and Limited Use disclosure expectations. See the Google OAuth verification page. ## Keeping the listing, dashboard, and policy aligned Reviewers compare the store listing description, the permissions in the manifest, the dashboard's data declarations, and the privacy policy. When an update adds a permission, a remote API, or analytics, update the declarations and the policy in the same release. Keep the policy URL stable so earlier reviews and user links keep working. ## Generating an extension policy The questionnaire does not have a dedicated extension platform, so choose the application platform and describe the data categories, collection sources, purposes, and providers truthfully, including AI or analytics services the extension calls. The hosted policy gives you a stable URL for the dashboard field and your extension's website, where you can add the Limited Use statement. ## Common questions ### My extension processes everything locally. Do I still need a policy? If it reads or handles user data at all, the store policy requires one. The policy can explain clearly that data stays in the browser and is not transmitted. ### Can I use analytics in an extension? Only in a way consistent with the single purpose, Limited Use, and your disclosures. Name the analytics provider and the data sent in the policy. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability.