Terms for a browser extension

A browser extension sits inside the user's browser with access to what they see and do, and its terms have to account for that: which permissions it uses and why, what it stores on the device, how it interacts with the websites the user visits, and how it makes money. The extension stores impose their own rules on data and behaviour, consumer law applies to anything the user pays for, and the privacy rules on storing and reading information on a device apply to extensions as they do to cookies. I draft those terms for a fixed fee of £995, delivered in five working days.

Who this is for

Businesses and developers in England and Wales publishing browser extensions for Chrome, Firefox, Safari, Edge and similar browsers, whether free, freemium, subscription or bundled with a wider product.

What matters in browser extension terms

Permissions, data and what the extension does

The terms should describe what the extension does, the browser permissions it requests and why each is needed, what data it reads from pages, tabs or the user's activity, what it sends to the business's servers and what stays on the device, and should refer to the privacy notice under the UK GDPR for the lawful basis and retention. Extension stores require a privacy disclosure that matches the code's behaviour, and terms that describe the extension differently from the store listing are the first thing a reviewer or a regulator compares.

Storing and reading information on the device

Storing information on, or gaining access to information stored on, a user's device requires the user's consent under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 unless it is strictly necessary for a service the user has requested, and an extension that stores identifiers or reads browsing data for analytics or advertising is within that rule. The terms should say what is stored and accessed and why, and the install flow should obtain the consent where it is needed rather than relying on the store's permission prompt.

Interaction with third-party websites

The extension modifies, reads from or acts on websites the business does not control, and the terms should say that the user is responsible for compliance with those sites' terms, that the extension may stop working when a site changes, that the business gives no warranty that any site permits the extension's use, and that automated actions the user directs through the extension are the user's actions. Extensions that scrape or automate should be drafted with the Computer Misuse Act 1990 in mind, since access beyond what a site authorises is an offence under section 1.

Monetisation and disclosure

Where the extension inserts affiliate links, replaces links, shows advertising, sells data, or offers a paid tier, the terms should disclose it plainly, because undisclosed affiliate injection is a misleading practice under Part 4 of the Digital Markets, Competition and Consumers Act 2024 and a breach of the stores' policies, and the sale of browsing data needs a lawful basis and transparency under the UK GDPR that most extensions cannot establish. A business that changes its monetisation after users installed should say so and let users remove the extension.

Free and paid versions, consumers and their rights

A free extension is provided as it is with no digital content rights under section 33 of the Consumer Rights Act 2015, while a paid tier is digital content under section 34 with rights that cannot be excluded, and a subscription carries the cancellation right under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and the subscription rules under Part 4 of the 2024 Act; the terms should keep the free and paid provisions apart, capture the consent to immediate supply under regulation 37 for paid content, and treat business users under the Unfair Contract Terms Act 1977 test.

Updates, removal and liability

The terms should say that the extension updates automatically through the store, that updates may change features or permissions with the store's prompt, that the business may withdraw the extension, and that the user may remove it at any time with data on the device deleted and server-side data handled as the privacy notice states. Liability should be limited within the Consumer Rights Act 2015 for consumers, including section 46 for damage to the device caused by the content, and the Unfair Contract Terms Act 1977 for businesses, with the business's IP in the extension protected under the Copyright, Designs and Patents Act 1988 and English law applying.

What it costs

SaaS terms of service, £995. Your standard customer-facing terms. Five working days.

Buying online forms the engagement on payment. The scope is what the saas and technology contracts page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A bespoke contract drafted for how your product is sold, delivered and supported
• Service levels you can meet, with remedies that are proportionate rather than aspirational
• A liability position that is defensible and will survive enterprise procurement
• IP and data provisions that fit together rather than contradicting each other
• A commercial note on where you will get pushback and what is worth conceding
• One round of amendments

What is not included

• Negotiating individual enterprise deals, which I quote separately
• Advice on the law of jurisdictions outside England and Wales
• Technical security certification or audit
• Regulatory advice for regulated sectors such as financial services or health

Questions I am often asked

Do we need consent to store a user ID in the extension?

If the identifier is used for analytics or advertising rather than being strictly necessary for what the user asked for, yes, under the rules on storing information on a device. The terms describe it and the install flow obtains it.

Our extension adds affiliate links to shopping sites. Is that lawful?

It can be, if it is disclosed clearly before installation and in the terms, and the stores' policies are met. Undisclosed link injection is where extensions are removed from stores and where consumer law bites.

A site blocked our extension and users want refunds. Are we liable?

For a free extension, no. For a paid tier, the terms say the extension depends on third-party sites the business does not control, and the refund policy applies; a paid tier sold on the promise of working with a particular site is a different matter.

Related guidance and services

• SaaS and technology contracts, £995, the service this page describes
• Contract review, £495
• Data protection agreements and privacy terms, £795
• Terms of service for a mobile app
• Terms for a freemium product

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.