Popular Chrome ad blocker extensions disclose selling users' browsing data to third parties

LayerX research found dozens of Chrome extensions, reaching millions of users, that legally sell or share user data under terms accepted at install. Among ad blockers, it confirmed eight reserving the right to sell or share user information, together reaching over 5.5 million users. Stands AdBlocker, with three million users, sells browsing data for market analytics, and Poper Blocker, with two million users, discloses selling identifiers, browsing activity, and behavioral profiles inferred from visited URLs. Smaller ad blockers route browsing data and even AI conversations through data brokers. The finding shows tools installed to stop tracking can themselves become data exfiltration channels, a browser extension supply chain risk static malware scanning misses.

Check

Inventory browser extensions across managed fleets, remove data-selling ad blockers like the named ones, and enforce an allowlist for permitted extensions.

Affected

Users who installed these ad blockers consented in the terms to having their browsing data, identifiers, and inferred profiles sold or shared with third parties.

Fix

Deploy an enterprise extension allowlist, review extension permissions and privacy terms, and educate users that ad blockers can monetize their data.