This document provides an overview of the Chrome Web Store review process and the enforcement actions that are taken when an extension violates the Chrome Web Store's policies. The enforcement practices described in this document are accurate as of the document's last updated date and are subject to change without notification. See [Lifecycle of a Chrome Web Store item](https://developer.chrome.com/docs/webstore/check-review#the_lifecycle_of_a_chrome_web_store_item) for an overview of how reviews fit in the lifecycle. The review process helps protect end users from scams, data harvesting, malware, and malicious actors seeking to take advantage of Chrome users, as well as from extensions that inadvertently violate policy. ## The basics When you submit an extension for review, the review team will review the extension for compliance with the [developer program policies](https://developer.chrome.com/docs/webstore/program-policies) and, if any violations are found, take appropriate [enforcement actions](https://developer.chrome.com/docs/webstore/review-process#enforcement). Existing items are also reviewed periodically for compliance. We do this because the extension ecosystem is constantly evolving; as malicious actors evolve their attacks or exploits are discovered, the review process must also evolve in response. Also, as the developer program policies change, we need to ensure that existing published items comply with current policy in order to protect end users. ## Review times Chrome Web Store review times can vary and may fluctuate for a number of reasons. For most extensions, review is completed within a few days, but it can take up to a few weeks. If you experience longer review times without making significant changes to your extension, this may be due to factors outside of your control including how many submissions we are handling at the time. > [!NOTE] > **Note:** If your extension is pending review for more than three weeks, please [contact developer support](https://developer.chrome.com/docs/webstore/review-process#support) to request assistance. The review process uses a combination of manual and automated systems. All submissions go through the same review system, regardless of the tenure of the developer or number of active users. However, some signals may cause the reviewer to examine an extension more closely, including: - new developers - new extensions - dangerous permission requests - significant code changes These signals may therefore cause the review to take longer. Review times may also be longer than normal after an extension has been rejected or warned. > [!NOTE] > **Note:** Note that all item submissions---whether for a new item or an update to an existing one---are subject to the same review process. ### Notable factors that increase review time Reviews may take longer for extensions that request broad host permissions or sensitive execution permissions, or which include a lot of code or hard-to-review code. Broad host permissions : [Host permissions](https://developer.chrome.com/docs/extensions/mv3/declare_permissions) patterns like `*://*/*`, `https://*/*`, and `` give extensions extensive access to the user's web activity, especially when combined with other permissions. Extensions with this kind of access can collect a user's browsing history, hijack web search behavior, scrape data from banking websites, harvest credentials, or exploit users in other ways. Sensitive execution permissions : Permissions grant extensions special data access and manipulation rights. Some permissions do this directly (for example, `tabs` and `downloads`) while others must be combined with host permissions grants (for example, `cookies` and `webRequest`). Review must verify that each requested permission is actually necessary and is used appropriately. Requesting powerful and potentially dangerous capabilities takes more time to review. Amount and formatting of code : The more code an extension contains, the more work it takes to verify that code is safe. Obfuscation is disallowed as it increases the complexity of the validation process. Minification is allowed, but it can also make reviewing extension code more difficult. Where possible, consider submitting your code as authored. You may also want to consider structuring your code in a way that is easy for others to understand. ## Review outcomes There are a number of possible pass/no-pass outcomes, depending on whether it's a publishing review or a periodic re-review. These outcomes are described in the following sections. ### Publishing review outcomes This section describes how we handle policy violations that we find while reviewing an extension submitted for publishing. > [!NOTE] > **Note:** Existing published items may also be checked for these same violations; that process is described in the [Periodic review outcomes](https://developer.chrome.com/docs/webstore/review-process#periodic-outcomes) section. Publish review requests have two basic outcomes. - **No violations are found:** The submission is approved and can be published to the Chrome Web Store. - **A violation is found:** The submission is [rejected](https://developer.chrome.com/docs/webstore/review-process#rejection) and the developer is informed why. See [Developer communication](https://developer.chrome.com/docs/webstore/review-process#comms) for details on how these outcomes are communicated back to the developer and how developers can contact the review team regarding the outcome. Finally, a third potential outcome is that the submission is found to contain malware or another extreme policy violation. See the [malware](https://developer.chrome.com/docs/webstore/review-process#malware) section for details on how these verdicts are enforced. ### Periodic review outcomes This section describes how policy violations are handled during the periodic review process. Note that a violation identified during the [publishing review](https://developer.chrome.com/docs/webstore/review-process#publish-outcomes) process may trigger a re-review of the currently published version of the extension. ![Illustration of potential review outcomes and policy enforcement practices. Text details found in the 'Periodic review outcomes' and 'Violation enforcement' sections.](https://developer.chrome.com/static/docs/webstore/review-process/image/illustration-potentia-9c316ca43b57a.png) Existing published extensions are occasionally subject to review outside of the standard submission time review process. Possible reasons for this include, but are not limited to regular periodic review, review triggered by a violation observed in a new submission, and user reports of unexpected or malicious behavior. There are four outcomes for review of a published item: - **No violations are found:** No action is taken. The extension remains on the Chrome Web Store. - **A minor violation is found:** A warning is sent to the developer about the violation. The developer has a set amount of time to address the violation before the item will be taken down. See [warning](https://developer.chrome.com/docs/webstore/review-process#warning) for more information. - **A more serious violation is found:** The extension is immediately taken down and the developer is notified of the violation. See [takedown](https://developer.chrome.com/docs/webstore/review-process#takedown) for more information. - **An extreme issue is found:** The extension is immediately taken down and the developer **is not** notified. See [malware](https://developer.chrome.com/docs/webstore/review-process#malware) for more information. See [Developer communication](https://developer.chrome.com/docs/webstore/review-process#comms) for details on how this is communicated and how to appeal the verdict. ## Violation enforcement In the event that a policy violation is identified during the review process, the Chrome Web Store will take appropriate action depending on the type of review being performed, the severity of violation, the discretion of the reviewer, and potentially other factors. ### Rejection Rejection can occur in response to a "Submit for review" request. If the submission is found to violate Chrome Web Store policy but is not an egregious policy violation, the submission will be rejected. In some cases, a violation detected in a submission may trigger a review of the published extension. If the violation is also found in the published version of the extension, additional enforcement actions may be taken. > [!NOTE] > **Note:** Rejection applies only when the submission is not found to contain malware or other extreme policy violation. If an extension is found to contain malware during the submission review process, proceed directly to [malware enforcement](https://developer.chrome.com/docs/webstore/review-process#malware). Developer communication : The publisher email address associated with the extension will be sent an email stating that the submission was rejected. The rejection emails will state which policy the extension violated and provide the developer with guidance on how to appeal the verdict. Chrome Web Store listing : The extension's listing in the Chrome Web Store is not affected; the description text, image assets, privacy disclosures, and published CRX all remain unchanged. Chrome UI : End users are not notified when a submission is rejected. ### Warning If a currently published item is found to contain minor policy violations, Chrome Web Store Review will notify the extension publisher of the violation via email. Depending on the violation, the publisher are typically given 7 to 30 days to address the issue(s). The extension developer can resolve the warning by submitting a new version of the extension that fixes the violation(s) using the standard submission process. If the violation is not addressed within the warning period, the extension will be taken down. The following information only covers the warning period. See [Takedown](https://developer.chrome.com/docs/webstore/review-process#takedown) for additional information on takedown handling. Developer communication : The publisher email address associated with the extension will be sent a warning email stating that the extension will be taken down due to one or more policy violations. The exact length of the warning period depends on the observed violation. If the developer does not resolve the violation(s) within the warning period, the publisher will receive another email explaining that the warning period expired and that the extension has been taken down. See [Developer communication](https://developer.chrome.com/docs/webstore/review-process#comms) for additional information about email communication. Chrome Web Store listing : The extension's Chrome Web Store listing is not affected during the warning period. The item will remain available for download and existing users will be able to update to the most recent successfully published version of the extension. Chrome UI : End users are not notified during the warning period. ### Takedown Takedown refers to the act of removing an extension from the Chrome Web Store. In most situations takedowns are not permanent: the extension's publisher can return the extension to the web store by submitting a new version that resolves the policy violation and passing the review process. Takedowns occur in two primary scenarios. First, immediate takedowns occur when reviewers detect one or more policy violations of moderate or greater severity in the published version of an extension. Second, delayed takedowns occur after the [warning period](https://developer.chrome.com/docs/webstore/review-process#warning) for a minor policy violation expires. In both cases, the impact of the takedown is the same. Developer communication : The publisher email address associated with the extension will be sent an email stating that the extension has been taken down due to one or more policy violations. In the case of an expired warning, the email will include a reference to the warning email the developer previously received. Chrome Web Store listing : When an extension is taken down, it will no longer be available in the Chrome Web Store. If normal users attempt to access the extension's listing, Chrome Web Store will return a 404 error. If a member of the publisher which owns the extension is logged into the Chrome Web Store, they will see the last published version of the extension and a warning at the top of the window indicating that the extension has been taken down. Additionally, the item won't appear in Chrome Web Store search results, collections, category listings, or elsewhere in the Chrome Web Store's consumer UI. Chrome UI : End users are not notified of the enforcement action immediately after takedown. If the violation remains unresolved for several weeks, Chrome will automatically disable the extension and notify the end user that the extension violates Chrome Web Store policy. Users may choose to re-enable the extension if they wish. ### Malware and extreme violations The Chrome Web Store Review team has special procedures for egregious policy violations. In cases such as malware distribution, deceptive behavior designed to evade review, repeated severe violations indicative of malicious intent, and other egregious policy violations, more drastic measures are necessary. To limit the potential for these developers to further harm users, the Chrome Web Store team intentionally does not provide details regarding these violations. Additionally, in more severe cases the developer's Chrome Web Store account will be permanently suspended. Developer communication : Unlike other enforcement actions, notification **is not** sent to the publisher's email address when the extension(s) are taken down. In the event that the developer's Chrome Web Store account is suspended, the developer will be sent an email to notify them of that enforcement action. Chrome Web Store listing : Just as with a [takedown](https://developer.chrome.com/docs/webstore/review-process#takedown), the offending item is removed from the Chrome Web Store. Chrome UI : The violating extension is disabled on all end user devices. Unlike standard takedowns, these extensions cannot be re-enabled. Chrome notifies the user that the extension has been disabled because it was found to contain malware. Users may choose to remove the extension or dismiss the dialog. ## Developer communication The Chrome Web Store review process has three primary ways of communicating with developers: 1. Automated emails sent to the extension publisher's email address. 2. Appeals created from the publisher accounts or the item details page in the Chrome Web Store Developer Dashboard. 3. Support tickets opened using the [One Stop Support](https://developer.chrome.com/docs/webstore/review-process#support) form. Once a ticket is opened or an appeal filed, all communication takes place over email. > [!NOTE] > **Note:** Though the team monitors and responds to various online forums where Chrome extensions are discussed, these platforms are primarily geared towards discussions about extension development and are not intended to be support channels. If you need to raise any concerns, it is recommended to use the CWS Support form. ### Automated emails In all but the most extreme policy violations, the Chrome Web Store will send developers automated emails informing them about the violation observed and the enforcement action taken. These emails state what policy or policies were violated, link to troubleshooting documentation related to the violation, and provide the developer with guidance on how to appeal the verdict. ### Appeals and One Stop Support Review verdicts and account suspensions can be appealed from the Chrome Web Store developer dashboard. For all other issues including trader verification, use the [One Stop Support contact form](https://support.google.com/chrome_webstore/contact/one_stop_support) to request assistance. Concerns that necessitate escalation, such as issues with dashboard stats, transfers between developers, and developer account recovery, may take longer than seven days to answer due to the complexity and in-depth investigation required to identify the root cause or explanation. **Appealing a review verdict** Use the following steps to appeal a [takedown](https://developer.chrome.com/docs/webstore/review-process#takedown) or [warning](https://developer.chrome.com/docs/webstore/review-process#warning). 1. Go to the item detail page in the [Chrome Web Store developer dashboard](https://chrome.google.com/webstore/devconsole/) and click the **Appeal** button. 2. Provide additional details as requested by the form. ![A screenshot of the Chrome Web Store developer dashboard showing the item detail page with the appeal button at the bottom.](https://developer.chrome.com/static/docs/webstore/review-process/image/item-appeal.png) **Appealing an account suspension** Use the following steps to appeal a developer account suspension. 1. Go to the account page in the [Chrome Web Store developer dashboard](https://chrome.google.com/webstore/devconsole/) and click the **Appeal** button. 2. Provide additional details as requested by the form. ![A screenshot of the Chrome Web Store developer dashboard showing the account page with a warning banner including the appeal button.](https://developer.chrome.com/static/docs/webstore/review-process/image/account-appeal.png) A few minutes after submitting a support request, you should receive an email with a unique ID for your support request. Depending on the size of the support queue and the specific violation, it may take up to three days to receive a reply. If you do not receive a response within that period, you can reply to the initial case email to request an update. > [!NOTE] > **Note:** As a developer in the European Union, if you have concerns related to the Platform To Business (P2B) regulations in Europe, you can raise them by filing through the [One Stop Support contact form](https://support.google.com/chrome_webstore/contact/one_stop_support).