What to declare on the Chrome Web Store privacy practices tab

Before the Chrome Web Store publishes an extension, its developer fills in the privacy practices tab in the developer dashboard. Reviewers compare the answers with what the extension actually does, and a mismatch is a common reason for rejection. This article walks through the tab field by field, with particular attention to analytics, which most developers add without thinking of it as "collecting user data".

This is not legal advice. Store forms and policies change, so check each answer against the current form before you submit.

The fields on the tab

Chrome's documentation lists what the tab asks for (Chrome: fill out the privacy fields):

1. A single purpose description, which helps reviewers "understand the focus of your extension". Every extension must have one narrow purpose; the description states it.
2. A justification for each permission your manifest declares. Remove any you do not need rather than justify them.
3. Whether you use remote code, and why. Manifest V3 prohibits loading remotely hosted code, so for almost every extension the answer is "No, I am not using remote code".
4. The kinds of data you collect, as a set of checkboxes.
5. Three certifications about how you use that data.
6. A link to your privacy policy, which should cover "how data is collected, used, and disclosed".

The single purpose and the permissions are about the extension itself. The last four are about data, and they are where analytics comes in.

Does analytics count as collecting user data?

Yes, if it sends anything about how the extension is used. Chrome's user data FAQ says extensions "may collect analytics or performance data where it is reasonably necessary to maintain, secure, or measure the performance and reliability of the extension's disclosed functionality", and that a privacy policy is required for any product that handles user information (Chrome: user data FAQ).

So analytics is allowed, and it must be declared. Leaving the boxes empty because the data is "just analytics" is the mismatch reviewers look for.

The data types, and where analytics falls

The tab lists these types, in this order:

• Personally identifiable information
• Health information
• Financial and payment information
• Authentication information
• Personal communications
• Location
• Web history
• User activity
• Website content

For typical product analytics, the ones to consider are:

• User activity. Interactions with the extension itself, such as which features are opened, settings changed and errors met, fall here. So does activity on websites, such as clicks or scrolling on the pages people visit, if you collect that.
• Location. If your analytics works out a country or region from the IP address, tick it, even though no precise location is stored.
• Web history. Only if you send the addresses or titles of the pages people visit, or their search terms. Most extension analytics should not, and then this stays unticked.
• Website content. Only if you send what is on the pages people visit. Again, analytics rarely needs to.
• Personally identifiable information. Only if you send a name, an email address, or an account number. A random identifier your extension generates is not one of these.

Tick what your extension actually sends, through every library it includes. If an analytics library adds the browser or operating system to each event, that is part of what you collect, and it belongs under user activity.

The three certifications

The tab asks you to certify three statements, each tied to the Limited Use policy:

1. "I do not sell or transfer user data to third parties, outside of the approved use cases." Services that work for you, such as an analytics or hosting provider, are an approved use; selling data, or giving it to advertising platforms or data brokers, is not.
2. "I do not use or transfer user data for purposes that are unrelated to my item's single purpose." Analytics used to improve the extension is related; using it for something else is not.
3. "I do not use or transfer user data to determine creditworthiness or for lending purposes."

The Limited Use policy itself says to "limit your use of user data to providing or improving your single purpose", lists the narrow cases where data may be transferred, and forbids transferring or selling it for personalised advertising or to data brokers (Chrome: Limited Use).

If you cannot honestly certify all three, the problem is the data practice, not the form.

The privacy policy

Every extension that collects user data needs a privacy policy at a public address, and the tab links to it. It should say what you collect, why, who receives it, how long you keep it, and how someone can ask about it or have it deleted. It must agree with the boxes you ticked: a policy that says "we collect nothing" beside a ticked "User activity" is a contradiction a reviewer will notice.

Name your analytics provider in the policy, or describe it as a service that processes usage data on your behalf, and link to what it collects.

Common mistakes

• Unticked boxes because the data is anonymous. The types describe what kind of data it is, not whether it identifies anyone.
• Forgetting a library. Crash reporters, feature-flag services and analytics all send data.
• A broad host permission "for analytics". Analytics does not need access to every site. If your endpoint answers cross-origin requests, it needs no host permission at all.
• A privacy policy written for the website, not the extension.

Common questions

Do I need a privacy policy if the data stays on the device?

Chrome's user data FAQ says the requirement applies to all products that handle user information, even when the data is stored locally only. If your extension handles user data at all, plan on a policy.

Is a random identifier personally identifiable information?

A random value your extension generates, which is not derived from anything about the device or the person and is not tied to an account, is not a name, an email address or an account number. It still belongs in your privacy policy, as part of how you count usage.

What if my extension's data practices change after it is published?

Update the privacy practices tab and your privacy policy in the same release that changes the behaviour, not after it. Reviewers check new versions against the current answers.

Does aggregated data still count?

What you collect is what you declare, even if you only ever look at totals. Aggregation matters for how you use the data, and the FAQ allows people to read data that has been aggregated and anonymised for internal operations. It does not remove the need to declare what you collect.

How AnalyticsTrend does it

AnalyticsTrend's extension SDK is a bundled package, so the remote code answer stays "No". It collects events you name, a random identifier, a country and sometimes a region worked out from the IP address, and the browser, operating system and device type, which on this tab means User activity and Location. The full list is in What it collects, and Store policy and privacy maps it to each store's form.

The free store disclosure helper works for any extension, whatever analytics it uses: tick what your extension collects, and it gives the boxes to tick on this tab, Firefox's manifest block, and a starting paragraph for a privacy policy. For the Firefox side, see Passing Firefox add-on review with analytics.

---

Checked against the Chrome Web Store's documentation on 7 October 2026.