Tony Wang7 min readWhat Chrome Extensions Collect About You: A 314,807-Listing Audit
We audited every Chrome Web Store listing's data-safety disclosures: 69,039 extensions collect data, 3,839 collect financial data, 994 health data.
Every Chrome Web Store listing carries a data-safety disclosure: a short, store-surfaced statement of what the extension's developer says it collects. It is self-declared. Google does not audit each claim, and the disclosure is the developer's own account of their extension's behavior, not our measurement of it. But it is a claim made in public, on the record, on the listing page a user reads before installing.
We pulled every one. Crawlora's Chrome Web Store dataset (index chrome_extensions_v1) holds 314,807 active listings — extensions, themes, and legacy apps — crawled in July 2026. For each listing we read the data-safety section and recorded which categories the developer declared. What follows is the aggregate. It describes what the store discloses, not what any single extension necessarily does.
Who declares collecting anything
Of 314,807 listings, 69,039 declare they collect user data. That is 21.9% — roughly one in five. The remaining four in five either collect nothing they disclose, or fall under an exemption. Separately, 49,257 listings (15.6%) request broad host access: the <all_urls> permission or its equivalent, which lets an extension read and change the content of every site you load. And 144,304 listings carry a privacy-policy link.
The category breakdown
The data-safety section sorts declarations into fixed categories. A single listing can declare more than one, so the counts below sum to more than 69,039. Here is how often each category appears across all 314,807 listings.
| Declared data category | Listings |
|---|---|
| Website content | 43,285 |
| Personally identifiable information | 29,788 |
| Authentication information | 22,587 |
| User activity | 17,144 |
| Web history | 10,485 |
| Personal communications | 7,004 |
| Location | 6,360 |
| Financial and payment information | 3,839 |
| Health information | 994 |
Website content leads by a wide margin. That fits the mechanics of an extension: reading page content is what most of them do, and declaring it is the honest label for a tool that operates on the page. Authentication information at 22,587 is a larger figure than it first looks, since it covers anything the developer classifies as login or credential data.
Financial data: expected scope and the outliers
3,839 listings declare they collect financial and payment information. That is the eighth of nine categories by volume, and the small count is the point: financial data is scope most extensions have no reason to touch. So the question is who the collectors are.
Ranked by install base, the largest declared financial-data collectors are these eight.
| Extension | Installs |
|---|---|
| Honey | 12,000,000 |
| Free VPN for Chrome - VPN Proxy 1clickVPN | 9,000,000 |
| NordPass Password Manager | 7,000,000 |
| Loom Screen Recorder | 7,000,000 |
| 1Password | 6,000,000 |
| Norton Password Manager | 5,000,000 |
| Hola VPN | 4,000,000 |
| Monica AI Assistant | 3,000,000 |
Three of these are password managers — NordPass, 1Password, Norton Password Manager — and financial-data scope is exactly what a password manager needs to store card and account details for you. Honey is a coupon and checkout tool, so payment context is close to its stated job. Those declarations describe tools doing what they are sold to do.
The declarations worth a second look are the two free VPNs. 1clickVPN (9,000,000 installs) and Hola VPN (4,000,000) both declare financial-data collection, and a VPN's advertised function — routing your traffic — does not obviously require it. We are not saying the data is misused; we are saying the disclosure is there, on a free product, and it is fair to ask why a free VPN's own listing says it collects payment information.
Health data: the smallest and strangest category
994 listings declare they collect health information. It is the rarest category in the store, which makes its named collectors more conspicuous than their raw counts. Ranked by installs, these six lead.
| Extension | Installs |
|---|---|
| ChatGPT | 2,000,000 |
| Solventum Fluency Direct Web Connector | 1,000,000 |
| Bless | 100,000 |
| Houzz Save Button | 90,000 |
| Add Pro Ad Blocker | 50,000 |
| Klara Chrome Extension | 50,000 |
ChatGPT tops the list at 2,000,000 installs. The plausible reading is not that it is a medical tool but that people paste health questions into it, and the developer declares the category because that content can arrive. Solventum's Fluency Direct is clinical-documentation software, so health data is its subject matter by design.
The declaration that does not fit its product is Add Pro Ad Blocker (50,000 installs). An ad blocker's job is to remove elements from pages. There is no part of that function that needs to collect health information, and its own data-safety section says it does. That is the single line in this table we would flag as genuinely hard to explain from the product alone.
What it means, and how to check for yourself
None of these figures are an accusation. They are a census of disclosures — what developers wrote in a store-mandated field, aggregated across the whole catalog. The value is in the pattern: 21.9% of listings declare collecting data at all, most declared collection is the mundane website-content kind, and the categories that should be rare (financial at 3,839, health at 994) mostly resolve to tools with a legitimate reason, with a short list of exceptions worth your attention.
You can run the same check on any extension you use. Crawlora exposes the Chrome Web Store as a queryable dataset: /datasets/chrome-extensions/search filters by permission and by the collects_data flag, so you can ask which extensions in a category declare financial-data collection, or which request broad host access, without reading listings one at a time. The data-safety section is also visible on any listing page in the store itself — the point of this audit is only that reading 314,807 of them at once shows you the shape of the whole store, which no single listing can.
Query the Chrome Web Store as a dataset
Search 314,807 extensions, themes and apps by permission, data-collection flag, adoption and category — or track permission and privacy changes over time. REST and MCP, 2,000 free credits a month, no card.
Frequently asked questions
How many Chrome extensions say they collect user data?
69,039 of the 314,807 active Chrome Web Store listings in Crawlora's July 2026 crawl (21.9%) declare in their data-safety disclosure that they collect user data. The disclosure is self-declared by the developer; Google does not audit each claim.
What data do Chrome extensions most often declare collecting?
Website content (43,285 listings), followed by personally identifiable information (29,788) and authentication information (22,587). 3,839 declare financial and payment information and 994 declare health information.
Does a data-safety disclosure prove an extension misuses data?
No. It is a declared capability, not evidence of wrongdoing. Password managers legitimately declare financial data, for example. The finding is how widespread the declarations are and which categories concentrate in which extension types.