AI Extensions That Sell Your Data (And How to Spot Them)

The AI browser extension market has exploded over the past two years, and the rapid growth has attracted companies whose primary business model is not selling AI features to you. It is selling your data to someone else. A 2025 study by a university research group found that 34% of AI-powered Chrome extensions transmitted browsing data to servers unrelated to their core AI functionality. Many of these extensions had millions of users and strong ratings in the Chrome Web Store.

This is not a call to avoid AI extensions entirely. They provide genuine productivity benefits that are hard to replicate any other way. But you need to be able to distinguish between extensions that respect your data and those that treat it as a revenue stream. Here is how to spot the difference.

Red Flag 1: The Extension Is Free With No Clear Business Model

Running AI models costs money. Claude, GPT-4, and Gemini all charge per token for API access. An extension that offers unlimited access to these models for free is either operating at a loss (unsustainable), using a lower-quality model than advertised, or monetizing something other than the subscription fee. That something is usually your data.

Some free extensions sell aggregated browsing data to advertising networks. Others sell anonymized usage patterns to market research firms. A few sell individual-level data to data brokers. The common thread is that the AI functionality is a hook to get you to install an extension that has broad access to your browsing activity.

This does not mean every free AI extension is problematic. Some offer genuinely free tiers with limited usage as a funnel to paid plans. Prophet, for example, provides a free tier with $0.20 in credits and clearly charges for additional usage. The key indicator is whether the free offering is a sample of a paid product or the entirety of what the company offers.

Red Flag 2: Excessive Permission Requests

Chrome extensions declare their required permissions in a manifest file, and Chrome shows you these permissions before installation. The permissions an AI extension requests should match its stated functionality.

Reasonable permissions for an AI sidebar extension:

• activeTab — access to the page you are currently viewing, only when you activate the extension
• storage — saving your settings and preferences locally
• sidePanel — displaying the extension in Chrome's side panel

Permissions that warrant scrutiny:

• tabs — access to information about all open tabs, including URLs and titles, even tabs you have not activated the extension on
• webRequest / webRequestBlocking — ability to intercept, modify, or block all network requests from your browser
• history — access to your complete browsing history
• bookmarks — access to your bookmarks
• <all_urls> — ability to read and modify content on every website you visit, all the time, without you activating the extension

An AI chatbot extension that requests access to your browsing history and all network requests is collecting far more data than it needs to answer your questions. Check the permissions by right-clicking the extension icon in Chrome, selecting "Manage extension," and reviewing the listed permissions.

Red Flag 3: Vague or Missing Privacy Policy

A legitimate AI extension should have a privacy policy that specifically addresses what browsing data is collected, how long it is retained, whether it is shared with third parties, and whether it is used for model training. Vague language is a red flag.

Concerning language:

• "We may share data with trusted partners" — who are these partners and what data do they receive?
• "We collect data to improve our services" — what data, specifically?
• "We may use aggregated data for research purposes" — what counts as aggregated, and who conducts the research?

Trustworthy language:

• "Page content sent to our API is not stored beyond the duration of the request"
• "We do not share individual user data with third parties for advertising purposes"
• "Chat history is stored in your account and deleted within 30 days of account closure"

If an extension does not have a privacy policy at all, do not install it. If the privacy policy is a generic template that does not mention AI processing, data retention, or third-party AI providers, treat it with suspicion.

Red Flag 4: No Transparency About AI Provider

Many AI extensions are wrappers around third-party AI APIs. When you use these extensions, your data passes through at least two organizations: the extension developer and the AI provider. A trustworthy extension discloses which AI provider it uses and links to that provider's data handling policies.

Extensions that are vague about their AI backend ("powered by advanced AI" without naming the provider) may be routing your data through multiple intermediaries. Each intermediary adds another organization that handles your data and another set of policies you need to trust.

Prophet is transparent about its AI stack: all AI processing uses Anthropic's Claude models, and Anthropic's data handling policies are publicly documented. The extension's open-source codebase lets you verify this claim by inspecting the API calls yourself.

Red Flag 5: The Extension Phones Home Constantly

A well-designed AI extension should only make network requests when you actively use it. If an extension is sending data to external servers while you are not interacting with it, something is wrong.

You can check this yourself using Chrome's developer tools:

1. Open Chrome DevTools (F12) and go to the Network tab.
2. Navigate to a few web pages without interacting with the AI extension.
3. Look for network requests originating from the extension. In the Network tab, you can filter by the extension's origin.
4. If you see requests being made on every page load, the extension is tracking your browsing activity.

Some extensions also send "heartbeat" requests at regular intervals, transmitting information about what tab is active and what page is loaded. This kind of passive data collection is a strong indicator that the extension is harvesting browsing data.

Red Flag 6: Data Collection Beyond the Active Page

An AI extension that helps you with the page you are viewing needs access to that page. An AI extension that collects data from pages you are not viewing, tabs you have not activated it on, or browsing sessions where you never invoked the extension is overreaching.

Check whether the extension uses content scripts that run on all pages versus only on the active tab when invoked. This information is in the extension's manifest file, which you can inspect by navigating to the extension's directory on your system or by using a manifest viewer tool.

How to Audit an Extension You Already Have Installed

If you are already using AI extensions and want to evaluate their data practices, here is a step-by-step audit process:

1. Review permissions. Go to chrome://extensions, find the extension, and click "Details." Review every permission listed and ask whether it is necessary for the stated functionality.
2. Monitor network traffic. Open Chrome DevTools, go to the Network tab, and use the extension normally for a session. Note what data is sent, to which servers, and how often.
3. Read the privacy policy. Find it on the extension's Chrome Web Store listing or website. Look for specifics about data retention, third-party sharing, and AI provider disclosure.
4. Check for source code availability. Search for the extension on GitHub. Open-source extensions can be fully audited.
5. Research the company. Look up the extension developer. Are they a company with a clear business model? Do they have a track record? Have they been involved in any data privacy incidents?

Why Open Source Is the Strongest Privacy Guarantee

Privacy policies are promises. Source code is proof. An open-source AI extension lets you verify every claim the developer makes about data handling. You can see exactly what the content script reads from each page, what the background script sends to external servers, and what data is stored locally versus remotely.

Open source also provides community oversight. Security researchers, privacy advocates, and other developers regularly audit popular open-source extensions and report issues publicly. This creates accountability that closed-source extensions, no matter how well-intentioned, cannot match.

Prophet's entire codebase, from the Chrome extension to the backend API, is publicly available. Any developer can clone the repository, build the extension from source, and verify that the installed version matches the published code. This level of transparency is the strongest guarantee that the extension does what it claims and nothing more.

What to Do If You Find a Problematic Extension

If your audit reveals that an extension is collecting more data than it should:

• Uninstall it immediately. Go to chrome://extensions and remove it.
• Review connected accounts. If the extension had access to Google, Microsoft, or other accounts via OAuth, revoke that access in each service's security settings.
• Change passwords. If the extension had access to pages where you entered passwords, change those passwords.
• Report it. Use the Chrome Web Store's "Report abuse" feature to flag the extension for policy violations.
• Find an alternative. Look for extensions that match your needs with better privacy practices. The best AI Chrome extensions balance functionality with responsible data handling.

The Bottom Line

AI browser extensions are powerful tools, but that power comes with access to your browsing data. The extensions worth trusting are the ones with clear business models, minimal permissions, specific privacy policies, transparent AI provider relationships, and ideally open-source codebases. Before installing any AI extension, spend five minutes checking these criteria. It is a small investment that protects your data from becoming someone else's product.