Updated Add-on policies — simplified, clarified

POST UPDATED: 4 August, 2025 — Updated policies for addons.mozilla.org (AMO) are now in effect. We also added a new section about implicit consent for self-evident, single-use data transmission.

Here’s a summary of the policy changes and their impact on AMO’s publishing process. Our main objective was to simplify and clarify Add-on policies for the developer community. The following policy updates will take effect on 4 August, 2025.

“Closed group” prohibition lifted

Closed group extensions are typically intended for internal or private use among a relatively small group of users. In the past AMO did not allow closed group extensions, but we’re lifting this prohibition to give developers more flexibility to publish restricted access extensions for any number of reasons.

Implicit consent for self-evident, single-use extensions

We’ve added new guidelines around implicit consent for single-use extensions in cases where using the feature obviously requires data transmission (must be apparent to users from the extension description/name and UI). Examples might include image search extensions, cloud-based language or grammar tools, file uploaders, etc. For these single-use, self-evident features, data consent is implied and developers are not required to ask for explicit consent. This policy addition furthers our efforts to streamline the developer experience.

Data consent and control terminology

We’ve updated terminology in an effort to clarify our policies related to user data consent and control.

A core aspect of our data policy is we only permit extensions to transmit data that’s necessary for functionality (and even so users must consent to data transmission). Prior policy language often intermingled the terms collection and transmission of data. This was often confusing for developers who naturally assumed these were two separate aspects of handling data. But in fact we are only concerned with the transmission of data outside of an extension or browser. Thus we’ve removed all references to the collection of user data and framed all data concerns around transmission.

Privacy policy not required to be hosted on AMO

In effort to reduce developer overhead and publishing friction, we are no longer requiring extensions to host privacy policies on AMO. Rather, we encourage developers to link to self-hosted privacy policies. Removing this requirement will allow developers to more easily update their privacy policies without necessitating the submission of an entirely new extension version on AMO.

Data collection transparency is of paramount importance to Firefox users. We’re also working on other changes that will make it easier for developers to select the types of data their extension requires, which will in turn provide enhanced data collection clarity for users.

User scripts API policy added

A user script manager is a type of extension that allows users to inject custom, website-specific scripts that alter a site’s appearance or behavior. These extensions leverage the userScripts API, which our policies now clarify may only be used by user script manager extensions. The userScript API may not be used to extend or modify the functionality of the script manager itself.

Source code submission guidelines

It has been a longtime AMO policy that all extension submissions must provide reviewable source code, regardless if it’s transpiled, minified, or otherwise machine generated. We’ve now amended our policy to more specifically stipulate that all dependencies must either be included in the source code package directly or downloaded only through the respective official package managers during the build process.

Taken together, we hope these policy refinements will make developing Firefox extensions a more straightforward and streamlined process. Let us hear your thoughts in the comments. Happy coding!