Firefox Extension Privacy Policy

How the Mozilla AMO Review Works

Firefox extensions are distributed through addons.mozilla.org, often called AMO. AMO has both automated and human review tracks, depending on what your extension does. Extensions that request sensitive permissions, request all sites access, or use remote scripts typically get human review.

During human review, a Mozilla volunteer or staff reviewer reads your privacy policy and compares it against your extension's behaviour. They check whether your manifest permissions match what the policy describes, whether the extension contacts any servers the policy does not name, and whether the data collection statement on your AMO listing is accurate.

Mozilla rejects extensions whose policies are generic boilerplate, do not name the extension, or contradict the extension's actual behaviour. Specificity is the single most important quality of a Firefox extension privacy policy.

The AMO Listing Data Collection Field

When you create or update an AMO listing, you fill in a data collection field that tells users at install time what your extension collects. This is separate from the privacy policy URL but must be consistent with it.

Be honest in this field. Users see it before they install. Mozilla penalises listings whose data collection field understates what the extension actually does, and reviewers will ask you to correct it.

If your data collection list and your privacy policy disagree, Mozilla treats it as a misleading listing. Always update both at the same time when something changes.

What a Firefox Extension Privacy Policy Must Include

Name your extension, your company or developer name, and a contact email at the top. Reviewers check that the document clearly belongs to the extension being submitted.

List every category of personal data the extension collects, accesses, or transmits. Be specific. Include any data sent to your own servers, any data sent to third party services, and any data stored locally that could be considered personal.

Describe how the data is used, who has access, how it is secured, and how long it is retained. Add a section explaining how users can request access, correction, or deletion. If your extension users are in the EU or UK, include the GDPR legal basis for processing.

End with a last updated date and a note about how users will be notified of material changes to the policy.

Common Issues Mozilla Reviewers Flag

Boilerplate policies that look like they were generated for a generic website. Mozilla flags these regularly. Customize the template to your specific extension before submission.

Missing third party disclosures. If your extension contacts Google Analytics, an error reporting service, an ad network, or any other third party, name them. Reviewers see the network traffic during testing.

Policies that contradict the manifest. If your manifest requests the history permission but the policy says we do not access browsing history, reviewers reject the listing. Make sure the policy reflects what the manifest enables.