Mozilla has announced changes to the rules for listing extensions in the AMO (addons.mozilla.org) directory. Starting from November 3, all new Firefox extensions that collect or transmit personal data to external servers must declare this activity in the manifest.json file. During the installation of the extension, the information about the operations with personal data will be displayed along with the permissions request.
Information about data collection will also be displayed in the extension manager (about:addons) under the "Permissions and Data" section and on the extension's page in the addons.mozilla.org directory.
The types of personal data operations must be specified in the manifest.json file through the "browser_specific_settings.gecko.data_collection_permissions" object. The developer can define methods for handling personal data that are always applicable as well as optional methods that can be disabled by the user.
The types of documented personal data include identifiable information (name, email, phone, address, age, etc.), financial information (credit card and account numbers, payment history), medical information (data about illnesses, tests), authentication parameters (logins, passwords, PINs), personal communications (emails, chat messages, social media posts), location data (GPS, region), browser activity (information about visited sites), website content (images and text from pages), interactions with websites (information about clicks, mouse and keyboard actions), search queries, bookmark information, and technical data (device information). "data_collection_permissions": { "required": [ "locationInfo" ], "optional": [ "technicalAndInteraction" ] }
New extensions that do not collect or transmit personal data should specify the value "none" in the "data_collection_permissions" object. For extensions that support Firefox versions up to 140 for PCs and 142 for Android, the need to provide an interface for managing data collection and transmission is maintained.
The requirement currently applies only to new extensions being listed in the AMO directory for the first time, and does not extend to the publication of new versions of existing extensions. The use of the new data collection declaration method is planned to become mandatory for all extensions in the first half of 2026. Extensions that do not comply with the new requirements or do not correctly set the "data_collection_permissions" object will not be digitally signed and accepted in the addons.mozilla.org directory.
Source: opennet.ru
