cwspy.com · July 26, 2026 · 8 min read
Chrome Extension Uninstall Tracking and Privacy
There is a real argument that Chrome extension uninstall tracking is a privacy hole. It goes like this: the browser hands an extension a way to make a network request at the exact moment a user has decided to stop trusting it, the user is never asked, and whatever the developer packed into that URL travels regardless. It is not a fringe view — a widely read critique argues that the setUninstallURL API violates user privacy outright, and it sits on the first page of results next to Google's own documentation. That deserves a straight answer rather than a defensive one — so this article covers where the criticism lands, where it does not, and how to collect uninstall feedback from your Chrome extension in a way you would be comfortable explaining to the person who just left.
Is Chrome extension uninstall tracking a privacy violation?
The mechanism is described in full in our uninstall URL guide, but the short version is that a developer registers a URL in advance and the browser opens it in a new tab after removal. Three things about that make critics uneasy, and two of them are fair.
- The user never consents to it. There is no prompt, no setting, and no indication before the fact that removing this extension will open a page. Fair — this is simply true.
- It fires at the moment of withdrawal. Someone has just decided to stop granting you access, and a request goes out anyway. Also fair, and the reason the timing feels worse than an equivalent request made yesterday.
- It can carry an identifier. Nothing in the API stops a developer from appending a stable ID and re-identifying the person as they leave. This is the part that is genuinely a hole — and note that it is a hole created by the developer, not by the browser.
The criticism lands hard against an uninstall URL carrying an identifier the user never agreed to. It lands very softly against one carrying a version number and an open question.
That distinction is the whole subject. The same API can be used to run a re-identification pipeline or to ask "what went wrong?" on an anonymous page. The technology does not choose; you do.
What data can you collect when someone uninstalls?
A practical test: could you show the departing user exactly what you sent, and would they consider it reasonable? Most decisions sort themselves out under that question.
| Data | Verdict | Reasoning |
|---|---|---|
| Extension version | Fine | Says nothing about the person. The single most useful field you can carry. |
| Locale, platform, coarse country | Fine | Non-identifying, and the receiving server observes most of it anyway. |
| A static campaign or store label | Fine | A property of the build, not of the user. |
| A per-install random ID | Only with disclosure | Defensible for deduplication, but say so in your privacy policy — and never reuse an ID that maps to an account. |
| Account ID, email, username | No | Re-identification at the moment of withdrawal. This is the practice the critics are describing. |
| Usage history, visited URLs, collected content | No | Far outside anything the user agreed to, and a fast route to removal from the store. |
The uncomfortable middle case is the per-install identifier. It has a legitimate use — telling one departure from a page reloaded three times — and a straightforward abuse: joining it to everything else you know. If you cannot articulate why you need it, do not send it. Counting page opens without an ID at all is usually enough.
The page is part of the privacy question
Developers focus on the URL and forget that the page it opens is also subject to scrutiny — often more so, because that is the part the user sees.
- Do not require an email address. Asking someone who has just left for contact details is the clearest possible signal that the page is for you rather than for them. It also collapses your response rate.
- Do not load third-party trackers on it. An advertising pixel on your uninstall page is exactly what the criticism is about, and it is the kind of detail people screenshot.
- Do not pre-fill anything you know about them. A page that greets a departing user by name proves you re-identified them.
- Make every field optional. Beyond being better design, it makes the page obviously non-coercive.
- Say what happens to the answer. One line under the field — that it is anonymous and read by the people who build the extension — costs nothing and changes how the page reads.
The design that satisfies both the privacy question and the response-rate question turns out to be the same one: a name, a question, one optional field, nothing else. That is not a coincidence. A page that collects the minimum is also the page people are most willing to answer, which is covered in more detail in building an uninstall feedback page.
Disclose it, in both places
Two disclosures matter, and neither is onerous.
Your privacy policy
State that removing the extension may open a feedback page, what that page records, and that the answer is optional and anonymous. If a third party hosts the page or stores the responses on your behalf, name them — that is a normal recipient disclosure and hiding it is the kind of omission regulators care about. If you handle data from users in Europe, this is the section that will be read.
Your store listing
Chrome Web Store requires developers to declare what data they collect and how it is used, and those declarations are shown to users before install — the rules are set out in the store's user data policy. Uninstall feedback belongs there if you collect anything beyond a page view. Mismatches between what your listing declares and what your extension does are a compliance problem quite apart from being a trust problem, and the store enforces it.
A closely related habit: keep your permissions honest in the first place. A large part of why uninstall tracking feels sinister is that it arrives after an extension has already asked for more access than users expected. An extension with narrow, well-explained permissions is not the one people suspect of harvesting data on the way out.
Why the honest version is still worth doing
It would be easy to read all of this as a case for not collecting anything. It is not, and the reason matters.
Without a departure signal, you are left with a user count that moves for unknowable reasons, store reviews written by a loud minority, and a bug tracker used by a technical few. The people who hit your worst problems — the feature that silently fails on long files, the conflict with another popular extension, the regression in last week's build — are the least likely to be in any of those groups. They remove the extension and say nothing, and the defect stays in your product driving away the next batch of users for exactly the same reason.
An anonymous question asked once, at the only moment the person has a reason to answer, is not surveillance. It is the least invasive way to find out that your software is broken.
The privacy-respecting version is not a compromised version. It collects the version number and a sentence — and the sentence is the part that actually fixes things. Identifiers were never what made the channel useful; they only ever made it harder to defend.
A privacy checklist for uninstall feedback
- Carry the extension version. Carry nothing that identifies a person.
- If you carry a per-install identifier, be able to say why, and disclose it.
- Never join uninstall data to an account or a profile.
- Keep the page free of third-party trackers and marketing pixels.
- Make every field optional; require no email and no account.
- Add one line on the page saying the answer is anonymous.
- Describe the page in your privacy policy, and name whoever stores the responses.
- Keep your store data declarations in step with what you actually do.
- Keep answers only as long as they are useful, then let them go.
Uninstall tracking earned its bad reputation from implementations that used a farewell as a last chance to identify someone. Do the opposite — ask one anonymous question, keep the version, disclose the page — and you get the most valuable feedback in your product with none of the exposure. The rest of the picture is in our overview of Chrome extension uninstalls and in what people actually write when you ask. Questions? Reach out through our contact form or email us at [email protected].