Full Report
Starting next month, Mozilla will require Firefox extension developers to disclose whether their add-ons collect or share user data with third parties. [...]
Analysis Summary
# Regulation/Compliance: Firefox Extension Data Collection Disclosures
## Overview
This summarizes Mozilla's new mandatory requirement for Firefox extension developers to explicitly disclose all data collection and sharing practices within their extension manifests, ensuring transparency to users during the installation process and on the add-on listing pages.
## Key Details
- Issuing Authority: Mozilla (for the Firefox Extension ecosystem)
- Effective Date: November 3, 2025 (for new extensions)
- Jurisdiction: Firefox Extension ecosystem (Applies to add-ons submitted to addons.mozilla.org)
- Status: Final (Taking effect soon)
## Requirements
### Mandatory Requirements
1. **New Extension Disclosure:** All newly submitted Firefox extensions must disclose data collection/sharing practices in the `manifest.json` file using the dedicated key: `browser_specific_settings.gecko.data_collection_permissions`.
2. **Explicitly State No Collection:** Extensions that collect *no* personal data must explicitly state this fact using the new framework.
3. **Transparency During Installation:** The disclosed data practices must appear during the user's installation prompt, alongside requested permissions.
4. **Public Listing:** Disclosed data practices must be visible on the extension's listing page on addons.mozilla.org and in the "Permissions and Data" section of `about:addons`.
5. **Existing Add-on Adoption:** All existing extension developers must adopt this new disclosure framework during their next update in the first half of 2026.
### Recommended Practices
1. Ensure that disclosures accurately reflect all data collected or shared, including PII obtained via extension APIs. (While not explicitly listed as optional, accurate declaration is key to avoiding submission blocks.)
## Affected Organizations
- Industries: Software development publishing extensions for the Firefox browser.
- Organization Size: Not specified; applies to all developers submitting to the Mozilla repository.
- Geographic Scope: Developers globally who wish to distribute add-ons via addons.mozilla.org.
## Compliance Timeline
- **November 3, 2025:** New Firefox extensions must comply immediately upon submission.
- **First Half of 2026:** All existing Firefox add-ons must update to adopt the new data collection disclosure framework upon their next update.
- **Ongoing:** Continued compliance required for maintenance updates and new submissions.
## Implementation Guidance
### Assessment Phase
- Review current extensions to identify all data collected or shared, including Personally Identifiable Information (PII) like names, emails, search terms, and browsing activity data (domains, URLs).
### Implementation Phase
- Modify the `manifest.json` file for each extension to incorporate the `browser_specific_settings.gecko.data_collection_permissions` key and define the collection scope.
- Ensure the extension update reflects that an update has been made to comply with the new consent framework.
### Validation Phase
- Verify that the declared data practices are correctly parsed by the browser and displayed to the user during the installation prompt before final submission.
## Technical Requirements
- Use of the specific manifest key: `browser_specific_settings.gecko.data_collection_permissions` within `manifest.json`.
- The system must accurately capture and categorize Personally Identifiable Information (PII) obtained via extension APIs, such as user data including names, email, search terms, and browsing activity data (domains, URLs).
## Penalties & Enforcement
- Fines: Not explicitly detailed.
- Other Consequences: Extensions that fail to properly declare their data collection practices **will be blocked from submission** to Mozilla's add-on repository. Developers will receive explanatory error messages.
- Enforcement: Automated screening during the submission process to the Mozilla add-on repository.
## Related Standards
- Mozilla Extension Workshop Documentation (Implied standard for manifest structure).
- General principles aligning with transparency requirements found in privacy frameworks (e.g., GDPR principles regarding informed consent, though this is platform-specific).
## Resources
- Official Documentation: Mozilla Extension Workshop documentation detailing the `data_collection_permissions` key (Link context provided in the original article).
- Guidance Documents: Mozilla blog posts explaining the changes (Mentioned in the context).
- Tools: N/A (The compliance mechanism is integrated into the submission pipeline).
## Practical Recommendations
1. **New Developers:** Implement required disclosures immediately for any new extension destined for Firefox, targeting November 3, 2025.
2. **Existing Developers:** Prioritize updating all current extensions to include the mandatory disclosure mechanism before the deadline in the first half of 2026.
3. **Data Minimization:** Since disclosure is tied to installation success, developers should strictly limit data collection to only what is absolutely necessary for the extension's function.
4. **Transparency Check:** Ensure that the user experience (installation prompt, add-on store page) accurately reflects the data usage policy.