Chrome’s August 1 extension data rules, explained

Four policy areas move together. The Limited Use Policy now says any user data an extension collects must be strictly necessary to its disclosed single purpose. Collecting “extra” for analytics, ads, or a feature you might ship later is no longer allowed.

Disclosure Requirements get sharper too: all data collection must be prominently disclosed — even when it is core to the extension’s job — and if practices change after install, the developer must tell users proactively. Separately, extensions built to bypass AI safety guardrails are now explicitly prohibited, and real-money predictive market tools join the regulated-goods ban list.

A lot of popular extensions grew by being a thin UI over a data pipeline — rewrite your prompt, “improve” your browsing, “sync” your history — while shipping transcripts or browsing data to a backend. The policy update attacks exactly that pattern: purpose and collection have to match, and the match has to be visible before install.

The timing is not accidental. Mid-July also saw reporting on extensions that silently exfiltrate AI chat conversations across ChatGPT, Claude, Gemini and others while the listing claimed nothing left the browser. When the store’s public story and the network traffic disagree, August 1 is Google’s answer.

Our catalog was already built around a narrow-permissions, local-first model: settings in chrome.storage, no accounts, no “improvement” backend that needs your page content. The August rules mostly confirm a direction we were already shipping toward, but we are still re-reading every listing against the new Limited Use and Disclosure language before the deadline.

If you maintain an extension: open the Privacy practices tab as a user would see it, list every network call the background worker makes, and delete anything that is not strictly required for the one sentence on your store listing. Then make sure that sentence and the disclosure match. Reviewers will compare them.

August 31 is when remaining Manifest V2 listings finish leaving the Chrome Web Store. Already-installed MV2 copies on older Chrome builds may keep running, but they stop updating and stop being reinstallable. If anything in your toolkit is still on MV2, this month is the last easy window to replace it.

Two August deadlines, one afternoon of hygiene: audit data practices for August 1, and clear out MV2 leftovers before August 31.