This document outlines the comprehensive Chrome Web Store Program Policies, which developers must adhere to for all extensions, applications, and themes. These policies aim to ensure a safe, secure, and trustworthy ecosystem built on transparency, protecting users from malicious content, privacy violations, and deceptive practices. Key areas covered include content guidelines (prohibiting sexually explicit, violent, or hateful material), safeguarding user privacy (requiring clear policies, limited data use, and secure handling), ensuring responsible marketing and monetization, and maintaining product quality and functionality. The document also details technical requirements, specific rules for Manifest V3 extensions, and the enforcement process for policy violations.
Chrome Web Store Program Policies: A Summary
Purpose & Scope: All developers must comply with these policies and the Developer Agreement to provide a safe, secure, and transparent environment in the Chrome Web Store. Policies apply to the entire user experience, including marketing materials and user-generated content.
Best Practices for Developers:
Research and understand all policies before development.
Extensions must add value, be useful, and unique.
No cheating: avoid misleading users, circumventing enforcement, copying others, or manipulating reviews/ratings.
Strict guidelines for user data collection, use, and disclosure, requiring explicit user consent for sensitive data.
Keep all extension information and metadata accurate and up-to-date.
Test extensions thoroughly for bugs and crashes.
Maintain correct contact information for important communications.
Provide detailed primary functionality in the single purpose field.
Offer meaningful customer support.
Stay informed about policy updates, which Google may issue at any time.
Fostering a Safe Ecosystem (Content Restrictions):
Mature & Sexually Explicit Material: Prohibits nudity, graphic sex acts, sexually explicit material, child pornography (zero-tolerance), and content promoting illegal sexual acts. Non-sexual nudity is allowed but may impact visibility; such products must be marked "Mature."
Malicious and Prohibited Products: Bans viruses, malware, spyware, phishing, unauthorized access to website content (e.g., paywalls), facilitating unauthorized download/streaming of copyrighted material, and cryptocurrency mining.
Hate Speech and Violent Behavior: Prohibits gratuitous violence, threats, harassment, bullying, and content inciting hatred based on protected characteristics (race, religion, gender, etc.). Also bans promotion or fundraising for extremist groups.
Regulated Goods and Services: Prohibits promoting unlawful activities (e.g., illegal sex work, prescription drugs without a prescription) and facilitating real-money gambling or the sale of regulated products (pharmaceuticals, alcohol, weapons).
Protecting User Privacy:
Privacy Policy: Required for any product handling user data; must be accurate, up-to-date, linked in the Developer Dashboard, and comprehensively disclose data collection, use, sharing, and third parties involved.
Limited Use: Mandates limiting data use to disclosed practices, prohibiting web browsing activity collection unless prominently described and user-facing. Restricts data transfer to third parties (only for providing/improving single purpose, legal compliance, security, or mergers with consent). Prohibits human reading of user data without explicit consent, aggregation/anonymization for internal operations, security, or legal compliance.
Prohibited Data Uses: Specifically bans transferring, using, or selling data for personalized ads, to advertising platforms/data brokers, or for credit-worthiness/lending purposes.
Affirmative Statement: Developers must disclose on their extension's website that data use adheres to the Chrome Web Store User Data Policy, including Limited Use requirements.
Use of Permissions: Request only the narrowest necessary permissions, avoiding "future-proofing."
Disclosure Requirements: Be transparent about handling user data; prominently disclose and obtain affirmative consent for data not closely related to primary functionality.
Handling Requirements: Securely handle user data (modern cryptography), avoid public disclosure of financial/payment/authentication information, and address security vulnerabilities promptly.
Ensuring Responsible Marketing and Monetization:
Impersonation & Intellectual Property: Prohibits impersonation, misrepresenting authorization/endorsement by other entities, mimicking OS/browser functionality, diverting users to fake Chrome Web Stores, and using misleading metadata (e.g., "Editor's Choice"). Bans infringement of intellectual property rights.
Deceptive Installation Tactics: Requires responsible marketing; functionalities must be clear, and user interactions must match reasonable expectations. Prohibits confusing ads, misleading interactive elements, hiding metadata, bundling other extensions, and requiring unrelated actions for functionality.
Accepting Payment From Users: Securely collect/transmit sensitive financial information, clearly describe products/services, post terms of sale, identify the developer as the seller, and comply with Google Checkout policies. Must clearly state if payment is required for basic functionality.
Misleading or Unexpected Behavior: Prohibits deceptive content, titles, descriptions, or screenshots. Device settings changes require user knowledge/consent and easy reversibility. No misrepresenting functionality or including non-obvious features (e.g., fake antivirus).
Ads: Must comply with content policies, be consistent with product rating, not use AdSense, be presented in context/clearly attributed, easily removable, and not simulate system notifications. Prohibits forcing ad clicks or personal info submission for ads. Ads must not interfere with third-party website ads, require clear disclosure, attribution, and not mimic native ads.
Affiliate Ads: Must be prominently disclosed. Affiliate links/cookies only permitted when providing direct, transparent user benefit related to core functionality, requiring related user action (e.g., no continuous background injection).
Building Quality Products:
Feature Products: The Web Store features products aligning with quality standards, potentially restricting visibility for VPNs, video downloaders, religious/political content, non-family-friendly content, bots, cryptocurrency, non-production builds, prohibited products, gambling, and developers with questionable reputations.
Spam and Abuse: Prohibits multiple extensions with duplicate experiences, manipulating rankings (e.g., fake reviews/installs), abusing notifications (spam, ads, phishing), and sending messages on behalf of users without confirmation. Must comply with Google's Webmaster Quality Guidelines.
Quality Guidelines: Extensions must have a single, narrow, easy-to-understand purpose; unrelated functionalities should be separate. Persistent UIs should enhance user tasks with minimal distraction, not hijack browsing or primarily serve ads.
Listing Requirements: Requires a complete, accurate, and up-to-date listing with descriptions, icons, and screenshots. Prohibits misleading, inaccurate, or keyword-spamming metadata and unattributed user testimonials.
Minimum Functionality: Prohibits extensions whose sole purpose is to install/launch another item, those with broken functionality, or those lacking basic utility/value (e.g., click-bait templates, linking to external services for core function).
Chrome Apps (Additional Guidelines): Packaged apps should leverage platform capabilities, detect offline states, and recover connectivity. Packaged/hosted apps should not require local executables, provide WebViews of unowned sites, download/execute dynamic scripts outside sandboxes, or misuse notifications.
Technical Requirements:
Code Readability: No obfuscation or concealed functionality, including external code. Minification is allowed.
API Use: Extensions must use existing Chrome APIs for their designated use cases; other methods for existing APIs are prohibited.
Additional Requirements for Manifest V3: Full functionality must be discernible from submitted code; external resources must not contain logic. Bans <script> tags pointing outside the package and JavaScript eval() or similar methods for remote code execution, except via documented APIs like Debugger or User Scripts (with specific exemptions for isolated contexts like iframes, if user data policies are met).
2-Step Verification: Required for all developer accounts to publish or update extensions.
Enforcement:
Enforcement Circumvention: Attempts to bypass limitations or enforcement result in immediate termination of developer accounts.
Notification and Appeals: Developers receive email notifications for product removal with instructions. Removals are permanent unless fixed. One appeal per violation is permitted; frivolous appeals may forfeit future rights.
Repeat Abuse: Serious or repeated violations, including intellectual property infringement, lead to suspension of developer accounts and potential bans from the Chrome Web Store and related Google services.