• Accurately inform users of a software’s purpose and intent. Users should download the software intentionally, with accurate knowledge of what will be downloaded, by clicking on an accurate advertisement that clearly informs the user of what will be downloaded. Advertisements leading the user to the download should not be deceptive or inaccurate, such as: 
  • Those claiming to update Flash if the program downloaded is unrelated to Flash.
  • An ad that only contains the words "Download" or "Play" without identifying the software it advertises for.
  • A "Play" button that leads to a download.
  • An ad that mimics the look and feel of the publisher’s website and pretends to offer content (for example, a movie) but instead leads to unrelated software.
  • Read about Social Engineering in our Online Security Blog.
• Behave as advertised. Your program should be clear about its functionality and intentions. If your program collects user data or injects ads into a user's browser, package these behaviors in clear language and do not frame them as insignificant features.
• Use endorsements only when authorized. Don’t use other companies’ logos in an unauthorized way to legitimize or endorse a product. Don’t use government logos without authorization. 
• Don’t scare the user. Software should not misrepresent the state of the user’s machine to the user, for example by claiming the system is in a critical security state or infected with viruses. Software should not claim to provide a service (for example, "speed up your PC") that it does not or cannot provide. For example, "free" computer cleaners and optimizers should not be advertised as such unless advertised services and components require no payment.

• Use the Google Settings API if your program changes Chrome settings. Any changes to the user’s default search settings, startup page, or new tab page must be made via the Chrome Settings Override API, which requires the use of a Chrome extension, as well as a compliant extension installation flow. 
• Allow browser and operating system dialogues to alert the user as intended. Do not suppress alerts to the user from the browser or from the operating system, notably those which inform the user of changes to their browser or OS. 
• We recommend that you sign your code. While an unsigned binary is not a reason for flagging your binary as unwanted software, we recommend programs have a valid and verified code signature issued by a code-signing authority that presents verifiable publisher information.
• Don’t degrade the security and protection measures provided by TLS/SSL connections. An application may not install a root certificate-authority certificate. It may not intercept SSL/TLS connections unless designed for experts to debug or investigate software. For more details, see the related Google Security Blog post.
• Protect user privacy. Software, including mobile apps, must only transmit private user data to servers as it is related to the functionality of the app, and these transmissions must be both disclosed to the user and encrypted.

• All extensions need to be disclosed and installed in Chrome to be policy-compliant. Extensions must be hosted in the Chrome Web Store, disabled by default, and compliant with Chrome Web Store policies (including the single-purpose policy). Extensions installed from a program must use the authorized Chrome Extensions installation flow, which will prompt the user to enable them within Chrome. Extensions may not suppress Chrome dialogues alerting the user to settings changes.
  
• Instruct users on how to remove a Chrome Extension. A good user experience is when a user uninstalls a program, everything that was installed along with it gets removed too. The uninstallation flow should include instructions for the user to disable and delete the extension themselves.

• Inform users of your intent to collect their data.  Provide users an opportunity to agree to the collection of their data before you start collecting it, including data about third-party accounts, email, phone number, installed apps, and files on the mobile device. Personal or sensitive user data collected should be handled securely, including being transmitted using modern cryptography (for example, over HTTPS). For non-Play apps, you must disclose your data collection to the user in the app. For Google Play apps, disclosure must adhere to Play policy. Do not collect data that goes beyond the published use of your application.

• Don’t impersonate another brand or app. Do not use improper or unauthorized imagery or design similar to another brand or app in a way that is likely to confuse the user.

• Keep all content within the context of the app. Apps may not interfere with other apps, or display ads or additional content to the user outside of the context or function of the app itself.

• The app should deliver on promises made to the user. All advertised functionality should be available to the user in the app. Apps may update app content but should not download additional apps without getting informed consent from the user.

• Keep behavior transparent. Apps should not uninstall or replace other apps or their shortcuts, unless that is the app’s stated purpose. Uninstall should be clear and complete. Apps should not mimic prompts from the device OS or other apps.

If Google Safe Browsing hasn't seen a particular binary before, Chrome may warn that it is uncommonly downloaded and could be dangerous. In these cases the warnings are lifted automatically if Google Safe Browsing verifies that it is benign.

If your site is showing uncommon download warnings, you can also request a review in Search Console.