Data Disclosure, Collection and Management
Add-ons must limit data collection to what is necessary for functionality, and must use the data only for the purpose for which it was collected. For the purposes of this policy, “data” includes all information the add-on collects, regardless of the manner of collection.
Privacy Policy
Add-ons that collect or transmit user data must maintain a privacy policy in the privacy policy field on addons.mozilla.org. The privacy policy must:
- be specific to the add-on, and not contain extraneous information or provisions unrelated to the add-on,
- set forth the data to be collected,
- If the collection of visited URLs or user search terms is required for the add-on to work, that collection must be disclosed in the privacy policy,
- If your add-on installs cookies, the placing and purpose of those cookies must be disclosed,
- disclose how the extension collects, uses, stores, and shares or discloses information about users,
- If data is sent to a third party, your policy must disclose the identity of those services,
- If your add-on enables third party websites to see that it is installed, that fact must also be disclosed,
- clearly describe the purpose of the data collection,
- be the full policy text; it cannot be a link to an externally hosted privacy policy.
A summary of this information must be included in the add-on’s description. Finally, you and your add-on must also comply with all applicable data privacy laws.
Prohibited Data Collection
- Search functionality provided or loaded by the add-on must not collect search terms or intercept searches that are going to a third-party search provider.
- Collecting, or facilitating the collection of ancillary information (e.g. any data not required for the add-on’s functionality as stated in the description) is prohibited.
- The collection of browsing activity is only permitted as part of the add-on’s primary function.
User Consent and Control
The user must be provided with a clear way to control the add-on’s data collection immediately after installation of the add-on. If data collection starts or changes in an add-on update, or the consent and control is introduced in an update, it must be shown to all new and upgrading users immediately after the update.
The data collection consent and control must be contained within the add-on. The consent experience must:
- Clearly state what type of data is being collected
- Link to the add-on’s privacy policy. For add-ons listed on addons.mozilla.org, the link must point to the privacy policy on addons.mozilla.org. Self-hosted add-ons that don’t have a listing on addons.mozilla.org should point to a self-hosted privacy policy.
- Inform about the impact of accepting or declining the data collection
If both personal and technical data is being collected, the user must be provided separate choices. If the user declines consent, the impact must be related to the data not being available.
Please refer to our best practices for advice and examples on how to design and implement a data collection consent prompt.
Add-ons installed in an enterprise environment can bypass the consent experience when they are installed by enterprise policy. For more information, refer to the enterprise documentation.
Personal Data (opt-in)
Personally identifiable information can be actively provided by the user or obtained through extension APIs. It includes, but is not limited to names, email addresses, search terms and browsing activity data, as well as access to and placement of cookies.
Before an add-on may collect personal information, it must clearly describe, and the user must affirmatively consent (i.e., explicitly opt-in) to the type of personal data being collected.
If the main functionality of the add-on does not work without collecting personal data, the add-on must provide a choice for the user to either accept the data collection or uninstall the add-on.
Technical & User Interaction Data (opt-out)
Technical data describes information about the environment the user is running, such as browser settings, platform information and hardware properties. User interaction data includes how the user interacts with Firefox and the installed add-ons, metrics for product improvement, and error information.
When an add-on collects either of these types of information, it must allow the user to disable that data collection (opt-out) during the initial consent experience.
Additional Privacy Protocols
- Leaking local or user-specific information to websites or other applications (e.g. through native messaging) is prohibited.
- If the add-on uses native messaging, the policies on user consent and control apply to any data sent to the native application as well. The privacy policy must clearly disclose which information is being exchanged with the application.
- Data from private browsing sessions must not be stored. Information that identifies a user across browsing sessions or containers must not be made available to web content.