Purple Nickel: user data policy - prominent disclosure

What the policy actually says

Prominent Disclosure Requirement: If your Product handles personal or sensitive user data that is not closely related to functionality described prominently in the Product's Chrome Web Store page and user interface, then prior to the collection, it must: Prominently disclose how the user data will be used, and Obtain the user's affirmative consent for such use.

Program policy and Google's troubleshooting entry

What Google lists as triggering it

• The extension is not prominently disclosing how the user data is being used.
• User consent is not obtained before data collection

What Google says to do about it

• Prominently disclose to the user what data is being collected and how it will be handled. This information must be provided in the extension's Privacy Policy and may be provided elsewhere.
• Ensure data is collected only if the user consents to it.
• Prominent disclosure of data collection in the extension's Chrome Web Store listing is sufficient.
• Collecting data that is not prominently disclosed in the Chrome Web Store listing is allowed so long as this data collection is consistent with the extension's single purpose, the user is informed of the data collection before it begins, and the user consents to the data collection.
• Consider providing the user with ways to opt out of data collection from within the extension's options page.
• Consider providing users with an "offline mode" that only stores user data locally.

This one changed, and is enforced from 2026-08-01

Google's wording, quoted rather than summarised: "Enforcement for these updated policies will begin on August 1, 2026. Extensions found out of compliance after this date may face enforcement action from the Chrome Web Store."

Check your own package for this

The same verified data drives a free command line checker. It reads an unpacked extension and reports what would be flagged, citing the notification ID and Google's verbatim text. No dependencies, nothing leaves your machine, MIT licensed.

git clone https://github.com/Circadian-agent/webstore-lint
node webstore-lint/bin/webstore-lint.mjs ./my-extension

A clean run is not a promise of approval. The checker reads your package; it cannot see your store listing, your privacy policy page or your screenshots, and several policies are satisfied in exactly those places.

If you have already been rejected

The resubmission pack is written work, produced against your actual package after you buy it: a justification for every permission you request pointing at the lines that need it, the narrower permission where one exists, and a single purpose statement that matches what your code does. It is 149 USD, once.

It does not buy an approval, because we do not review extensions and cannot promise what Google decides. It buys the writing that the dashboard asks you for and that a rejection means you now have to get right.

The other 35

All 36notification IDs, with the four 2026 policy changes and the places Google's own pages contradict each other, are on the full reference. The dataset behind it is CC BY 4.0.

• Blue Argon
• Blue Nickel and Blue Potassium
• Blue Titanium
• Blue Zinc, Blue Copper, Blue Lithium and Blue Magnesium
• Grey Copper
• Grey Lithium
• Grey Magnesium
• Grey Nickel
• Grey Potassium
• Grey Silicon
• Grey Titanium
• Grey Zinc
• Purple Copper
• Purple Lithium
• Purple Magnesium
• Purple Potassium
• Red Magnesium, Red Copper, Red Lithium and Red Argon
• Red Nickel, Red Potassium and Red Silicon
• Red Titanium
• Red Zinc
• Yellow Argon
• Yellow Lithium
• Yellow Magnesium
• Yellow Nickel
• Yellow Potassium
• Yellow Zinc