AI Chrome extensions send page data to models, so redaction and consent matter

Why the privacy question got louder

As dev.to reported, in a post originally published on ExtensionBooster, Google's Chrome team said at I/O 2026 that 17% of extensions built for the Chrome Web Store over the past year use AI. That is roughly one in six. Each of those extensions passes some portion of what you are looking at to an AI model. Note that we are getting the figure second-hand, so check Google's own I/O material before repeating it.

The post argues that two investigations from late 2025 explain why users have grown wary. Both involved extensions that looked legitimate in the store.

Two cases that broke trust

In December 2025, Koi Security looked at four extensions from a single publisher. Together they had more than 8 million users. According to the post, they siphoned off conversations from around ten AI services, with ChatGPT, Claude and Gemini among them. The main one worked by intercepting the browser's network requests, gathered data by default, and offered no way to turn that off.

On December 30, 2025, OX Security reported on two AI sidebar extensions with more than 900,000 users between them. Every 30 minutes they sent ChatGPT and DeepSeek conversations, plus the addresses of every open tab, to a remote server. The only consent users saw was a prompt about analytics described as anonymous.

In both cases at least one of the extensions carried a Featured badge. The lesson drawn is that a badge says little; what an extension visibly does is the real evidence.

What the store and the model vendors require

The Chrome Web Store has no separate AI policy. Its general user-data rules apply, and a July 2026 update, enforced from August 1, 2026, tightened them. The main points as the post summarizes them:

• Send only the data the extension's single purpose strictly needs.
• Handing data to a model API must be necessary for that purpose.
• Humans may not read user data by default, unless there is explicit consent, anonymized aggregates, or a security or legal reason.
• Browsing activity may be used only as a prominently described feature users can see.
• Consent has to appear inside the extension itself. A privacy policy or store listing text does not count.
• Anything leaving the browser must travel over HTTPS.

The update also bans extensions designed to get around AI services' safety guardrails.

Builders also inherit their model provider's terms. The post says OpenAI's API does not train on inputs by default, and keeps abuse-monitoring logs for up to 30 days. Zero Data Retention, which means not keeping the data at all, needs approval. Google's free Gemini API tier may use inputs to improve its products, and human reviewers may read them once they are detached from the account. The paid tier does not train on inputs. Chrome's built-in on-device AI keeps text on the device. The post's rule of thumb: never route personal data through the free Gemini tier.

Send less, and scrub what you send

The guide's central advice is to narrow what leaves the page. Instead of requesting access to every site, an extension can use the activeTab permission or a right-click menu so the user decides exactly which text goes out. In the sample code, a right-click action takes the highlighted text, cuts it to 4000 characters and posts only that. No page address, title or user ID goes along.

Before sending, a small redaction step replaces email addresses, API-style tokens, card-like numbers and phone numbers with placeholders. Redaction by pattern is crude and will miss things, but it catches the obvious leaks. Two further habits: keep the model's API key on your own server rather than in the extension, and ship a default block list of sensitive sites, such as online banking, health portals and password managers, where AI stays switched off. Users can add to it.

Ask plainly, then show your work

Before the first request, the post says to show a consent page covering four things: what is sent, where it goes, how long it is kept and who can read it. The "Turn on AI features" and "Not now" buttons should look equally prominent, and the rest of the extension should still work if someone declines.

The sample code stores a consent version number. If the data flow changes, the version goes up and users are asked again. After consent, the extension should keep showing what happens: a "sent to AI" indicator, a local list of the last 20 requests and one AI on/off switch in the popup.

The same story should appear on the store listing. It should name the model provider, say what is sent and how long it is kept, and match the privacy answers and policy. If a store review raises a privacy concern, the post recommends replying within a day with specifics.