# Most big Firefox add-ons still don't say what they collect

> Mozilla said every Firefox add-on would declare its data collection by mid-2026. Most popular ones still don't, and one that did got buried in one-star reviews.

18 October 2026 · #firefox #privacy #browser-extensions #mozilla · https://blog.peng.ly/firefox-add-ons-data-labels/

Here's what Firefox showed me this morning when I went to install two password managers:


  ![Firefox's prompt to add Bitwarden Password Manager. It lists six required permissions, like accessing your data for all websites and the clipboard, then an optional setting for private windows. There's no data collection section.](https://raw.githubusercontent.com/NotAFlightRisk/blog/main/posts/firefox-add-ons-data-labels/bitwarden-prompt.png)

_Bitwarden 2026.10.0, out on 15 October_

  ![Firefox's prompt to add LastPass. It lists five required permissions, then a Required data collection section saying the developer says it collects browsing activity, website activity, authentication information and location, then a pre-ticked box to share technical and interaction data.](https://raw.githubusercontent.com/NotAFlightRisk/blog/main/posts/firefox-add-ons-data-labels/lastpass-prompt.png)

_LastPass 4.154.2_


Which one's telling you more? LastPass, obviously. It's got a whole "Required data collection" section, and a pre-ticked box for sending the developer technical data. Bitwarden's just stops after the permissions, and it'd be easy to read that as "collects nothing".

But, that's not what this actually means.. An add-on that really collects nothing will say so in the prompt - Proton Pass's says "The developer says this extension doesn't require data collection." Bitwarden's has no data section at all, since nobody's made Bitwarden fill it in.

Since [3 November 2025](https://blog.mozilla.org/addons/2025/10/23/data-collection-consent-changes-for-new-firefox-extensions/), every new add-on on addons.mozilla.org (AMO) has had to put a `data_collection_permissions` key in its manifest, even if it's only to say "none", and Firefox 140+ shows it in that prompt. Add-ons that already existed were let off, but Mozilla said that wouldn't last:

> In the first half of 2026, Mozilla will require all extensions to adopt this framework. But don't worry, we'll give plenty of notice via the add-ons blog.

The first half of 2026 ended in June. The add-ons blog hasn't mentioned it since, and nothing's changed. AMO's API reports the key for every add-on, so I went through the top 1,000 by users to see how far the labels have actually got.

## Updated since July, and still nothing

Of the top 1,000, 776 show nothing. Most of those haven't shipped a new version since November, so they never had a reason to add the key. The 21 made since November are fine, 20 of them declare something, which is what happens when it's actually enforced. So I split the other 979 by when their current version was uploaded:

| Current version uploaded  |   Says something |
| :------------------------ | ---------------: |
| Before 3 Nov 2025         |  2 of 475 (0.4%) |
| 3 Nov 2025 to 30 Jun 2026 |  57 of 161 (35%) |
| Since 1 Jul 2026          | 145 of 343 (42%) |

Adblock Plus, AdGuard, Dark Reader, DuckDuckGo, Ghostery, NoScript, 1Password, MetaMask and Bitwarden have all shipped since July, and none of them say anything. I downloaded each one to check the API wasn't lying, and the key just isn't in their manifests. They're 9 of the 198 in that last row that left it out, and those 198 have about a third of the top 1,000's daily users between them.

That's Mozilla's deadline, not theirs. Nobody told them to add it (more on that next), and silent doesn't mean they're collecting anything. uBlock Origin and Privacy Badger both bothered to say "none". It just means the prompt can't tell you either way.

## Nothing makes them

Why haven't they? Mostly beacuse they don't have to. AMO's upload check [upload check](https://github.com/mozilla/addons-server/blob/2571f276a22ea251e34e71c82ba3f5ae3f40449d/src/olympia/devhub/tasks.py#L402-L429) only turns a missing key into an error when it's a brand new add-on uploaded through the developer hub. An update gets a warning, and that [warning](https://github.com/mozilla/addons-linter/blob/1850fb845eccd80df0e16c6bc068c347d13f3c66/src/messages/manifestjson.js#L902-L913) still says the key "will be required for new versions of existing extensions in the future". Mozilla's [docs](https://extensionworkshop.com/documentation/develop/firefox-builtin-data-consent/) say older add-ons "will have to at a later date", with no date.

The nearest thing to news is [a reply](https://discourse.mozilla.org/t/the-new-data-transmission-permissions-seem-to-be-misleading-to-users/149410/6) from Mozilla's add-ons team on thier forum, on 10 September:

> Even though we haven't retroactively asked all the published Add-ons to comply with this policy, we do it every time they submit a new version/update.

From the code, I think "asking" there is that warning. The same reply says "I can't promise anything specific right now".

## Being honest costs you

When an older add-on adds the key for the first time and says it collects something, every existing user gets asked to agree, and if they say no the update doesn't install. Saying "none" doesn't do that. Firefox has a way round it: a `has_previous_consent` flag that says users already agreed to whatever the add-on did before, so the update [goes through without a prompt](https://github.com/mozilla-firefox/firefox/blob/6210f73af7ef7df6878d8f2d78599bf73e39c5ca/toolkit/mozapps/extensions/AddonManager.sys.mjs#L1311-L1326). But AMO's linter has rejected that flag since October 2025, in a change titled ["Prevent the use of has_previous_consent for now"](https://github.com/mozilla/addons-linter/pull/5807).

Return YouTube Dislike found out what that means. It's got about 900,000 daily users, and on 7 September it shipped its first update in nearly two years, declaring personally identifying information, browsing activity, website content and website activity. Its developer says all it gets is a random user ID and the IDs of the videos, which is how it counts dislikes in the first place. That sounds like a lot for a dislike button, but Mozilla's [examples](https://extensionworkshop.com/documentation/develop/firefox-builtin-data-consent/) for personally identifying information include "ID numbers", and browsing activity covers even "domains", so I can see how it got there. Here's what happened on [its reviews page](https://addons.mozilla.org/en-US/firefox/addon/return-youtube-dislikes/reviews/):

**One-star reviews of Return YouTube Dislike on AMO** ([the data](https://raw.githubusercontent.com/NotAFlightRisk/blog/main/posts/firefox-add-ons-data-labels/one-star-weeks.json))

_A week at a time, from Mondays, up to 11 October. Version 4.0.6 came out on 7 September_

It went from about one a week to 101 in a week. "Spyware", "data mining scam", "At what point does a youtube dislike add-on need my personal data?". One reviewer was sure the developer's account had been hacked. My favourite was this one, which sort of gets it and still gives one star:

> The fact that the data processing method hasn't changed means it was being collected all along.

To be fair to the reviewers, the same update added premium statistics (likes over time, maps by country), and some of the reviews are about that. But about half of the 224 one-star reviews since 7 September mention the data or the permissions, some quoting Firefox's prompt word for word. The developer [put it](https://discourse.mozilla.org/t/the-new-data-transmission-permissions-seem-to-be-misleading-to-users/149410/2) on Mozilla's forum as "calling my reviews section a shitstorm is an understatement".

The first post in that same thread is from SponsorBlock's developer. It's a similar sort of add-on, talking to its own server about YouTube videos, and they were working out which boxes they'd have to tick. Probably browsing activity, they thought, maybe website content. SponsorBlock's current version came out in July and doesn't declare anything, so its 820,000 daily users get a nice clean prompt.

So nothing makes the quiet add-ons say anything, and the flag that would let the honest ones say it without a fight has been blocked by AMO "for now" for a year. Untill one of those changes, the add-ons that tell you the most look the worst, and the ones that tell you nothing look fine.