You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fix and improve various built in consent experience related links (#2283)
* Fix and improve various built in consent experience related links
* Added anchors to remaining policy sections
Updated last updated information on all pages
If your extension collects user data, it must comply with the requirement of the [Data Disclosure, Collection and Management](/documentation/publish/add-on-policies/#data-disclosure-collection-and-management) section of the [Add-on Policies](/documentation/publish/add-on-policies/).
20
+
If your extension collects user data, it must comply with the requirement of the [Data Collection and Transmission Disclosure and Control](/documentation/publish/add-on-policies/#data-collection-and-transmission-disclosure-and-control) section of the [Add-on Policies](/documentation/publish/add-on-policies/).
21
21
22
-
A common developer question about these policies is how to translate them into browser extension features that are compliant to [Mozilla’s Add-on policies](/documentation/publish/add-on-policies/). This how-to is the result of those requests and offers advice on implementing prompts to meet the data collection and add-on policies. This article suggests how you can implement suitable prompts but it doesn’t replace or supersede the policies; you still need to confirm that your extension complies with the policies.
22
+
A common developer question about these policies is how to translate them into compliant browser extension features. This how-to is the result of those requests and offers advice on implementing prompts to meet the data collection and add-on policies. This article suggests how you can implement suitable prompts but it doesn’t replace or supersede the policies; you still need to confirm that your extension complies with the policies.
23
23
24
24
::: note
25
25
Firefox provides a built-in consent for data collection and transmission in Firefox for desktop 140 and later, and Firefox for Android 142 and later. See [Firefox built-in consent for data collection and transmission](/documentation/develop/firefox-builtin-data-consent/).
@@ -48,7 +48,7 @@ To create the consent flow and consent dialogs your extension needs, you should
48
48
1. Does my extension collect technical or interaction data? If so, offer the user the opportunity to opt-out of this data collection, although you can always offer opt-in consent if you prefer.
49
49
2. Does my extension collect personally identifying information? If so, get the user’s opt-in consent before collecting any of this data. Remember that personally identifying information includes technical or interaction data tagged with the user’s identity or information that can be used to identify the user, such as an URL.
50
50
51
-
If you are unsure whether your add-on collects personal, technical, or interaction data, refer to the definition in [Data Disclosure, Collection and Management](/documentation/publish/add-on-policies/#data-disclosure-collection-and-management).
51
+
If you are unsure whether your add-on collects personal, technical, or interaction data, refer to the definition in [Data Collection and Transmission Disclosure and Control](/documentation/publish/add-on-policies/#data-collection-and-transmission-disclosure-and-control).
52
52
53
53
“Data” includes all information the extension collects, regardless of the manner of collection or the reason for collection. This also includes data collected as part of the extension’s primary functionality.
54
54
@@ -94,7 +94,7 @@ As part of your extension’s onboarding flow, include information about your pr
94
94
95
95
For more information on how to implement a post-install page or dialog, see [Best practices for onboarding, upboarding, and offboarding users](/documentation/develop/onboard-upboard-offboard-users/).
96
96
97
-
As mentioned in the [Add-on policies](/documentation/publish/add-on-policies/), if your extension collects user data in association with features that run in the background, such as ad blocking, you need to make sure the data collection is not activated until you have obtained user consent.
97
+
As mentioned in the [Add-on policies](/documentation/publish/add-on-policies/#data-collection-and-transmission-disclosure-and-control), if your extension collects user data in association with features that run in the background, such as ad blocking, you need to make sure the data collection is not activated until you have obtained user consent.
98
98
99
99
If an update to your extension collects new personally identifying information, existing users must consent to the new data collection (opt-in) when your extension updates.
Copy file name to clipboardExpand all lines: src/content/documentation/develop/firefox-builtin-data-consent.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ contributors:
13
13
rebloor
14
14
]
15
15
last_updated_by: rebloor
16
-
date: 2025-08-04
16
+
date: 2026-03-12
17
17
---
18
18
19
19
<!-- Page Hero Banner -->
@@ -27,7 +27,7 @@ Firefox supports built-in consent for data collection and transmission in Firefo
27
27
28
28
From November 3, 2025, all new extensions must adopt the Firefox built-in data collection consent system. Extensions must state if and what data they collect or transmit. New versions and updates for add-ons created before November 3 don’t need to use this feature, but will have to at a later date.
29
29
30
-
Implementing the built-in consent feature doesn't remove the obligation to create a [custom data collection experience](documentation/develop/best-practices-for-collecting-user-data-consents/) for use when installing on Firefox versions from before the feature's introduction. See [Data collection experience on older Firefox versions](#data-collection-experience-on-older-Firefox-versions) for implementation advice.
30
+
Implementing the built-in consent feature doesn't remove the obligation to create a [custom data collection experience](/documentation/develop/best-practices-for-collecting-user-data-consents/) for use when installing on Firefox versions from before the feature's introduction. See [Data collection experience on older Firefox versions](#data-collection-experience-on-older-Firefox-versions) for implementation advice.
31
31
32
32
For updates on the rollout and the timeline for AMO accepting submissions using this feature and for tips on how to take advantage of it, see the [community blog](https://blog.mozilla.org/addons/).
33
33
:::
@@ -53,7 +53,7 @@ Firefox uses categories to standardize data collection information for developer
53
53
54
54
Personally identifiable information can be actively provided by the user or obtained through extension APIs. It includes, but isn’t limited to, names, email addresses, search terms, and browsing activity data, as well as access to and placement of cookies.
55
55
56
-
| Data type<br>visible during install | Data collection permission<br>used in the manifest | Definition and examples | Eligible for [implicit consent](/documentation/publish/add-on-policies/#data-collection-and-transmission-disclosure-and-control)? |
56
+
| Data type<br>visible during install | Data collection permission<br>used in the manifest | Definition and examples | Eligible for [implicit consent](/documentation/publish/add-on-policies/#implicit-consent-for-self-evident-single-use-extension)? |
|**Personally identifying information**|`personallyIdentifyingInfo`| Examples: contact information such as name and address, email, and phone number, as well as other identifying data such as ID numbers, voice or video recordings, age, demographic information, or biometric data. | no |
59
59
|**Health information**|`healthInfo`| Examples: medical history, symptoms, diagnoses, treatments, procedures, or heart rate data. | no |
Copy file name to clipboardExpand all lines: src/content/documentation/publish/add-on-policies.md
+80-10Lines changed: 80 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,8 +16,8 @@ contributors:
16
16
kmaglione,
17
17
dotproto,
18
18
]
19
-
last_updated_by: dotproto
20
-
date: 2025-09-17
19
+
last_updated_by: rebloor
20
+
date: 2026-03-12
21
21
---
22
22
23
23
<!-- Page Hero Banner -->
@@ -47,6 +47,14 @@ When an add-on is given human review or otherwise assessed by Mozilla, these pol
47
47
48
48
Users should be able to easily discern the functionality of your add-on based on the listing, and should not be presented with unexpected user experiences after installing it. The listing should include an easy-to-read description of what the add-on does, and what information it transmits. Please consult our best practices guide for [creating an appealing listing](/documentation/develop/create-an-appealing-listing/).
49
49
50
+
{% endcapture %}
51
+
{% include modules/column-w-toc.liquid,
52
+
id: "no-surprises"
53
+
content: content_with_toc
54
+
%}
55
+
56
+
{% capture content %}
57
+
50
58
### Unexpected features
51
59
52
60
“Unexpected” features are those that are unrelated to the add-on’s primary function, and are not clearly indicated by the add-on name or description. This may include features that impact user privacy or security, make unexpected changes to web content, or change default settings like the new tab page, homepage, or search engine.
@@ -58,9 +66,9 @@ Any “unexpected” feature(s) must adhere to all of the following requirements
58
66
* The opt-in interface must clearly state the name of the add-on requesting the change.
59
67
60
68
{% endcapture %}
61
-
{% include modules/column-w-toc.liquid,
62
-
id: "no-surprises"
63
-
content: content_with_toc
69
+
{% include modules/one-column.liquid,
70
+
id: "unexpected-features"
71
+
content: content
64
72
%}
65
73
66
74
<!-- END: Content with Table of Contents -->
@@ -100,6 +108,13 @@ Add-ons must function only as described. During review, the add-on undergoes bas
100
108
101
109
If corrections have been requested and are submitted as part of a new version, the new version should not contain unrelated changes, as this complicates the review process and can lead to further delays or rejections.
102
110
111
+
{% endcapture %}
112
+
{% include modules/one-column.liquid,
113
+
id: "submission-guidelines"
114
+
content: content
115
+
%}
116
+
{% capture content %}
117
+
103
118
### Source Code Submission
104
119
105
120
Code must be provided in a way that is reviewable. Add-ons may contain transpiled, minified or otherwise machine-generated code, but Mozilla needs to review a copy of the source code before any of these steps have been applied.
@@ -175,15 +190,31 @@ Add-ons must limit data transmission to what is necessary for functionality, and
175
190
176
191
If the add-on uses native messaging, the Add-on Policies (including those related to user consent and control) apply to any data sent to the native application as well.
* Search functionality provided or loaded by the add-on must not transmit search terms or intercept searches that are going to a third-party search provider.
181
204
* Transmitting or facilitating the transmission of ancillary information (e.g. any data not required for the add-on’s functionality as stated in the description) is prohibited.
182
205
* The transmission of browsing activity is only permitted as part of the add-on’s primary function.
183
206
207
+
{% endcapture %}
208
+
{% include modules/one-column.liquid,
209
+
id: "prohibited-data-collection-and-transmission"
210
+
content: content
211
+
%}
212
+
213
+
{% capture content %}
214
+
184
215
### User Consent and Control
185
216
186
-
The user must be provided with a clear way to control the add-on’s data transmission, either through a consent experience created by the add-on developer, or by using Firefox’s built in data collection and transmission consent experience. In the case of add-ons that qualify for implicit consent, under the “Implicit Consent for Self-Evident, Single-Use Extension” policy, installation is the consent.
217
+
The user must be provided with a clear way to control the add-on’s data transmission, either through a consent experience created by the add-on developer, or by using Firefox’s built in data collection and transmission consent experience. In the case of add-ons that qualify for implicit consent, under the [Implicit Consent for Self-Evident, Single-Use Extension](#implicit-consent-for-self-evident-single-use-extension) policy, installation is the consent.
187
218
188
219
Add-ons installed in an enterprise environment can bypass asking for data collection consent when they are installed by enterprise policy. For more information, refer to the [enterprise documentation](/documentation/enterprise/enterprise-development/). If the add-on uses Firefox’s built-in data collection and transmission consent experience, then the browser will bypass this by default.
189
220
@@ -208,6 +239,14 @@ If both personal and technical data is being transmitted, the user must be provi
208
239
209
240
Please refer to our [best practices](/documentation/develop/best-practices-for-collecting-user-data-consents/) for advice and examples on how to design and implement a data transmission consent prompt.
210
241
242
+
{% endcapture %}
243
+
{% include modules/one-column.liquid,
244
+
id: "user-consent-and-control"
245
+
content: content
246
+
%}
247
+
248
+
{% capture content %}
249
+
211
250
#### Personal Data (opt-in)
212
251
213
252
Personally identifiable information can be actively provided by the user or obtained through extension APIs. It includes, but is not limited to names, email addresses, search terms and browsing activity data, as well as access to and placement of cookies.
@@ -216,8 +255,15 @@ Before an add-on may transmit personal information, it must clearly describe, an
216
255
217
256
If the primary function of the add-on does not work without transmitting personal data, the add-on must provide a choice for the user to either accept the data transmission or uninstall the add-on.
218
257
219
-
#### Implicit Consent for Self-Evident, Single-Use Extension
258
+
{% endcapture %}
259
+
{% include modules/one-column.liquid,
260
+
id: "personal-data-opt-in"
261
+
content: content
262
+
%}
220
263
264
+
{% capture content %}
265
+
266
+
#### Implicit Consent for Self-Evident, Single-Use Extension
221
267
222
268
Implicit consent applies only to add-ons hosted on addons.mozilla.org when all of the following conditions are satisfied. Otherwise the standard explicit consent rules apply.
223
269
@@ -237,20 +283,36 @@ Implicit consent applies only to add-ons hosted on addons.mozilla.org when all o
237
283
238
284
When all the above conditions are met, invoking the primary function is deemed implicit consent for transmitting the user-supplied data needed to perform that function. No additional dialog needs to be shown at install time. If any other data is transmitted, explicit consent at time of install is required.
Technical data describes information about the environment the user is running, such as browser settings, platform information and hardware properties. User interaction data includes how the user interacts with Firefox and the installed add-ons, metrics for product improvement, and error information.
243
297
244
298
When an add-on transmits either of these types of information, it must allow the user to disable that data transmission (opt-out) during the initial consent experience. The add-on functionality must not be restricted if the user declines transmission of this data.
245
299
300
+
{% endcapture %}
301
+
{% include modules/one-column.liquid,
302
+
id: "technical-and-user-rnteraction-data-opt-out"
303
+
content: content
304
+
%}
305
+
306
+
{% capture content %}
307
+
246
308
### Additional Privacy Protocols
247
309
248
310
* Leaking local or user-specific information to websites or other applications (e.g. through native messaging) is prohibited.
249
311
* Data from private browsing sessions must not be stored. Information that identifies a user across browsing sessions or containers must not be made available to web content.
@@ -282,6 +344,14 @@ When an add-on transmits either of these types of information, it must allow the
282
344
283
345
We expect all add-ons, whether hosted on addons.mozilla.org or not, to be secure and well-maintained in how they handle both their own data and their users’ data. They must also securely manage all of their interactions with the web and the browser and the operating system.
284
346
347
+
{% endcapture %}
348
+
{% include modules/one-column.liquid,
349
+
id: "security-compliance-and-blocking"
350
+
content: content
351
+
%}
352
+
353
+
{% capture content %}
354
+
285
355
### Policy Enforcement
286
356
287
357
Mozilla may reject or block affected versions or entire add-ons that don’t comply with the above policies, depending on the extent of their non-compliance.
@@ -294,7 +364,7 @@ For more information about rejection and blocking, see [What does review rejecti
0 commit comments