Google has announced new policies for Chrome extensions and Drive that will restrict third party apps’ access to user data. Chrome extension developers will now be required to request the least amount of user data their app needs to function. Third party apps like Pixlr that connect with Google Drive to function in some situations, will now be be barred from accessing all files. The changes have been brought under Project Strobe that was launched last year to review how third party apps handle users’ Google account and Android device data.
Google says there are more than 180,000 extensions in the Chrome Web Store, and nearly half of all Chrome desktop users actively use extensions to customise Chrome and their experience on the web. “We’re requiring extensions to only request access to the appropriate data needed to implement their features. If there is more than one permission that could be used to implement a feature, developers must use the permission with access to the least amount of data,” Ben Smith, Google Fellow and Vice President of Engineering, said in a blog post. Google also said that under the new rules, extensions are required to post privacy policies. This will also include extensions that handle personal communications and user-provided content.
Additionally, the updated policy for third party apps that seek access to users’ Google Drive, will also give users more control over what data they can access in Drive. The apps will now be required to seek permission from the user each time they need access to a file. “With this updated policy, we’ll limit apps that use Google Drive APIs from broadly accessing content or data in Drive. This means we’ll restrict third-party access to specific files and be verifying public apps that require broader access, such as backup services,” Smith explained.
Google says that the announcement is being made in advance to give developers the time needed to ensure their extensions will be in compliance. These changes will go into effect early next year.