Firefox Extensions need to disclose data collecting starting November 3, 2025
Browser extensions extend the functionality of a web browser or the displayed websites and apps. They can be very useful, for instance to block advertisement, prevent tracking, enable bulk downloading, change something on a website, or help improve your browsing in other ways.
However, the popularity has also led to the rise of extensions that do not have the best of users at heart or at all. From malicious extensions to browser add-ons that collect and sell user data.
Mozilla announced an upcoming change to the Firefox extension ecosystem that has far-reaching consequences. Extensions "will be required to specify if they collect or transmit personal data" starting November 3, 2025, writes Mozilla in a new blog post on the official add-ons blog.
The important details:
- The change applies to new extensions only at first, not new versions of existing extensions.
- All extensions will have to disclose the information in the first half of 2026.
- Extensions that do not collect or transmit anything still have to specify this.
- The information is displayed to users during installation of an extension.
When an extension collects data, Firefox displays the data that it collects as part of the installation prompt. Mozilla shared an image of an extension that collected the location information according to the data the developer provided.
Extensions that do not collect any data still have a "data collection" section listed. Mozilla reveals here that the developer stated that the extension does not collect any data.
Mandatory for all extensions from 2026 onward
Initially, only new extensions are required to provide data collecting information. Existing extensions may add the information voluntary, but need to continue doing so once started.
Mozilla revealed that all Firefox extensions will be required to provide the information from 2026 onward. The organization has not set a specific date at the time, but mentioned that it would likely become mandatory in the first half of 2026.
Extensions that do not have the information in their manifests but are required to will be prevented from being submitted to the Firefox extensions repository. Mozilla says that developers will receive an error message during signing if that is the case, so that they know why an extension was not signed.
Closing Words
Clearly, Mozilla wants to improve transparency when it comes to the collection of user data by extensions. That is a good decision, even though the information the developer provides does not appear to be verified automatically. This is not different from how other extension stores or application stores handle the information though.
The change could be disruptive. Mozilla has not revealed how it plans to deal with extensions that are no longer updated. Will they stop working altogether because of the missing information by 2026?
Now You: what is your take on the change? Good move by Mozilla to improve transparency, or do you fear, that some Firefox extensions will no longer function in the browser once the new policy gets mandatory for existing extensions? Feel free to leave a comment down below.
Mozilla already provides this information doesn’t it? In the addons manager there’s a button called “Permissions” for every single addon the user has installed. In each of those permissions, there’s a link to “Learn more about permissions” which leads to this site: https://support.mozilla.org/en-US/kb/permission-request-messages-firefox-extensions?as=u&utm_source=inproduct#w_access-your-data-for-all-websites
Every permission type and what it entails is detailed on that page. So nothing new with the planned requirement to disclose data collecting unless the devs are going to be forced into disclosing the fees they receive from advertisers, or whoever they pass the data onto.
As for blocking extensions which haven’t been updated for a while I think that would be a big mistake. A lot of the ones I use date from several years ago, but I really wouldn’t want to be without them.
This feels like copium for the removal of their promise to never sell our data.
Make visual changes to let us users feel like they care about our privacy.
If they would actually care about our privacy they would test the extensions rigorously themselves and show us what their results imply.
Nowadays extensions go bad without their developers even intending to. Developers get hacked or blackmailed. Supply chain attacks aren’t going away either.
Just asking developers for their input isn’t gonna stop the people with bad intentions.
I don’t understand exactly what’s happening here?
Are they just asking and Mozilla takes them at their word?
What are the ramifications for lying? Is Mozilla conducting random checks?
Dev says they collect data (a ton of it) and we install the extension anyway. So is this really about offloading any responsibility off of Mozilla and unto the users?
Sloppy but that’s what it sounds like. At least we’ll be slightly better informed.
Anything about devs creating a clean extension and then selling it later to data-brokers? This is huge issue.
Manage updates manually on untrusted extensions – the end user has ALWAYS been in charge of what they install