Edge Extension Privacy Policy Requirements

How Edge Privacy Rules Differ From Chrome

Edge extensions are based on the same WebExtensions API as Chrome, so most code ports directly. The privacy review, however, is run by Microsoft and follows the Microsoft Edge Add ons Developer Policies, not the Chrome Web Store policies.

Edge places stronger emphasis on data minimisation. Microsoft expects extensions to collect only what is strictly necessary for the stated function and to aggregate or anonymise data wherever possible. A privacy policy that lists broad data categories without specific justifications is more likely to draw questions from Edge reviewers than from Chrome.

Edge also requires that user sensitive data is encrypted in transit, that data sharing with any third party requires opt in consent, and that the privacy policy refer specifically to the Edge browser when it discusses data flows tied to that browser.

What an Edge Extension Privacy Policy Must Disclose

Describe every category of user data your extension collects or accesses. This includes browsing history, page content, form data, identity, cookies, location, and any other category covered by your manifest permissions.

Describe how data is used, who it is shared with, and how users can exercise control. Microsoft expects an explicit description of how a user can opt out, request deletion, or see what is stored.

Describe security measures. At minimum, name the transport encryption used (TLS 1.2 or higher) and any storage encryption applied to sensitive data. If you do not encrypt at rest, say so and explain why it is acceptable for the data type.

Identify any third party services your extension communicates with. Include analytics, error reporting, and any backend you operate. Reviewers cross check by inspecting network traffic and will reject extensions whose policy omits a service that the extension actually contacts.

Common Reasons Edge Reviewers Reject Extensions

Reusing the Microsoft privacy statement instead of writing your own. Edge developer policies explicitly prohibit this unless your extension is an official Microsoft product. Always write or generate a policy that names your extension and your company.

Vague data descriptions. Phrases like we may collect some information that helps us improve the product are not enough. Be specific about what is collected, why, and where it goes.

Missing third party disclosures. If your extension uses Google Analytics, Sentry, Mixpanel, or any other service, name it in the policy. Reviewers compare network traffic against the policy and a mismatch fails the review.

Submitting and Updating Through Partner Center

Edge extensions are submitted through Microsoft Partner Center. The privacy policy URL field is on the Properties tab of your extension submission. Paste the public HTTPS URL where your policy is hosted.

Submit the privacy questionnaire alongside the policy. The questionnaire asks the same kinds of questions as Chrome's data handling certification. Make sure your answers match what your policy says.

When you update the extension code, review the privacy policy at the same time. If your update adds new data collection, network endpoints, or permissions, the policy must be updated before the new version is submitted.