Are translation extensions safe? Google Translate, DeepL & Immersive Translate privacy review

You hit a page in a language you don't read, click the little translate button, and the whole thing flips to English in a second. Magic. Except the magic has a shipping address: for most translation extensions, the text on that page just left your browser and traveled to a server somewhere to get translated.

That's fine when the page is a news article. It's a different story when the "page" is your webmail, a shared Google Doc, an internal company wiki, or a medical portal you skim-translated without thinking. So let's go through the popular ones — Google Translate, DeepL, and Immersive Translate — and figure out what they actually read, where it goes, and when you should reach for an on-device option instead.

Quick verdict

• Cloud translation means your page text leaves your browser. To translate a page, these extensions send its text to a remote server. That's how cloud machine translation works — it's not a bug, but it is a data flow you should know about.
• They request broad page access. Full-page translation needs the extension to read the content of whatever site you're on, which usually means the "read your data on all websites" grant.
• DeepL is EU-based and GDPR-bound, and its policy treats free-tier and paid (DeepL Pro) text handling differently — worth reading before you paste anything sensitive.
• Immersive Translate is a router, not a single engine. Its privacy depends entirely on which backend you point it at, which is both its strength and its catch.
• My take: for casual reading, cloud translators are fine. For anything private, use your browser's built-in on-device translation, which never sends the text anywhere.

What these extensions actually do

The job is straightforward: take text in one language and give it back to you in another. Some translate only the snippet you select; most can flip an entire page in place, swapping the original text for the translated version right in the DOM.

To do the full-page version, the extension has to read the page content. It grabs the text nodes, ships them off to a translation engine, gets back the translated strings, and rewrites the page. The selection-only mode is lighter — it only touches what you highlight — but the convenient "auto-translate this whole site" feature is the one that needs to see everything.

That reading capability is the core of the privacy question. The extension isn't doing anything sneaky by reading the page; it literally cannot translate text it can't read. The thing to watch is which pages it reads and where the text goes once it has them.

Security analysis: the permission footprint

Full-page translation extensions typically ask for host access across all sites, plus the scripting ability to rewrite page content. In manifest terms that's <all_urls> host permissions paired with scripting — and the host grant is the single most powerful one the browser hands out. I broke down exactly what it unlocks in my earlier piece on the "all sites" host permission, but the short version: an extension with it can read and modify the content of any page you open.

For a translator, that access is justified by the feature. You can't auto-translate arbitrary sites without permission to touch arbitrary sites. But "justified" and "harmless" aren't the same thing. The same grant that lets the extension translate a Spanish news site also lets it read your bank dashboard, your inbox, and your company's internal tools — because to the browser, those are all just "all sites."

The mitigation is that Chrome, Edge, and Firefox all let you downgrade host access to on click or on specific sites. Most people never change the default, which is usually "on all sites." Flipping it to on-click turns a translator from "always watching" into "only when I ask," and for this category that's the single most effective setting you can change.

Where the text goes

Here's the split that actually matters for privacy: cloud versus on-device.

Google Translate, the official extension, is a cloud service. When you translate a page, its text is sent to Google's translation servers and the result comes back.

Google is a public company with a published privacy policy, and translation is a core, legitimate product — but the data flow is real: the page content does leave your machine. As with any large provider, the protection you're relying on is policy, not technical isolation.

DeepL also processes text on its own servers, and it's worth a separate note because the company is based in Germany and therefore operates under GDPR. DeepL's documentation distinguishes how it handles text on the free tier versus paid DeepL Pro, with the paid product marketed around not retaining your texts. If you translate sensitive material regularly, that distinction is the part of the policy to read closely — and it's a reminder that "free" translation usually has a different data bargain than the paid version.

Immersive Translate is a different animal. It's a popular bilingual translator that doesn't run its own engine — instead it routes your text to a backend you choose, which can be Google, DeepL, an OpenAI-style model, or others.

That means its privacy posture isn't fixed: it's whatever the engine you selected does with your text. Powerful and flexible, but it also means the question "is this safe?" has no single answer — it depends on what you wired it up to, and your text still leaves the browser to reach that backend.

None of this makes these extensions malware. They're legitimate tools doing exactly what they advertise. The point is that "translate this page" quietly equals "send this page's text to a third party," and that's a trade you want to make on purpose, not by reflex on a logged-in tab.

Privacy breakdown: how I'd score them

I won't slap a fake number on any of these — pull the live report and judge for yourself. But the privacy story sorts along two axes: how much of your browsing the extension can reach, and where your text travels once it's read.

On reach, they're roughly even: full-page translators want broad host access, and most default to all sites. On destination, they diverge.

A cloud translator sends text to its provider every time. A router like Immersive Translate sends it to whichever engine you picked. And an on-device translator — which we'll get to — sends it nowhere.

The honest scoring rule for this whole category: the danger isn't the translation, it's the standing permission. An extension that can read every page to translate one of them is one ownership change or one bad update away from reading every page for some other reason. I've written before about how broad permissions become a liability when an extension changes hands, and translators sit squarely in that risk class because their whole job requires the maximum grant.

The on-device alternative

The cleanest fix for the data-flow problem is to not have a data flow at all. Both major browsers now ship local translation that runs on your machine.

Firefox has done on-device translation since 2022. The engines and language models run entirely on your computer, so the page text never goes to the cloud — it was built with the Bergamot research project specifically to keep translation private and offline. It supports a solid list of languages, downloads the models on first use, and then works without a network connection.

Chrome added a built-in Translator API that does the same thing: an on-device model handles the translation locally, without involving the cloud, with language packs downloaded on demand. It's exposed to web pages and extensions as a standard Translator interface, and on desktop Chrome it means a lot of everyday translation can happen without your text leaving the browser at all. (Note it's desktop-only for now, and the first translation for a language pair pauses to download the model.)

So the practical hierarchy looks like this:

1. Use the browser's built-in local translation for anything private. No third-party extension, no all-sites grant, no text leaving your device.
2. If you need an extension, restrict it to on-click or to specific sites. Don't let a translator watch your logged-in tabs by default.
3. Match the engine to the sensitivity. Casual article? Any cloud translator is fine. Internal docs or personal data? On-device or nothing.

Final recommendation

Translation extensions aren't a scam, and I'm not telling you to uninstall them in a panic. Google Translate, DeepL, and Immersive Translate are real tools from real teams, and for reading a foreign-language page they're genuinely useful.

But treat "translate this page" as what it really is on the cloud versions: "send this page's text to a server." For public content, who cares. For anything you wouldn't paste into a stranger's chat window, switch to your browser's on-device translation, or at minimum pin the extension to on-click so it isn't reading every tab you open.

The broad host permission these tools need is the same one the scary extensions need — the only difference is intent, and intent can change with an update.

Want to see exactly what a translation extension requests before you install it? See the security report → in the Extenshi catalog, or scan the extensions you already have to find which ones are quietly reading every page you open.

---

This article is based on publicly available security research and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].