A browser extension that helps you shop needs permission to see the pages you shop on. That is simply how extensions work, and it is why the business model behind a free one is worth understanding before you install it. The model determines what the software is motivated to do with that view. None of this is hypothetical any more: the past two years have produced court cases, a regulator's fine and one very public reckoning that together map out exactly where the money comes from.
Affiliate commission, and the fight over the last click
The biggest model is affiliate commission. When you buy something, the retailer pays a small percentage to whoever referred you, and referral is decided by "last-click attribution": whichever tag touched your visit last gets the credit. A free extension that sits in your browser is, by design, always in a position to touch your visit last.
The best-known example is Honey, the coupon-finding extension PayPal bought in 2019 for about four billion dollars — its largest acquisition ever, made when Honey had roughly seventeen million monthly users. That price only makes sense once you see the position, not just the product: a seat at the very end of millions of purchase journeys.
In December 2024 a YouTube investigation by the creator MegaLag accused Honey of using that seat to swap in its own referral tag at checkout, taking credit — and commission — for sales that creators and publishers had actually driven. Within weeks the lawyer-YouTuber LegalEagle had filed a proposed class action, and dozens of similar cases were consolidated in a California federal court. PayPal has denied wrongdoing and defended last-click attribution as standard industry practice, and to date the courts have largely sided with it: a judge dismissed the consolidated creators' claims in late 2025, though litigation continues.
Whatever the courts finally decide, the episode showed millions of people something most had never considered: a free coupon tool can be a party to the transaction, with its own stake in the outcome. And the incentive is structural, not particular to one company. In July 2026, the AI shopping app Phia — no relation to Honey — was accused of "cookie stuffing", claiming affiliate credit for purchases it had not driven; the company disputed the characterisation. Different tool, different decade, same last click.
A free extension sits at the end of your purchase journey. The business model decides what it does when it gets there.
Data, the quieter model
The second model is quieter: the browsing itself is the asset. Histories of what you searched, visited and bought have real commercial value in aggregate, and the clearest case on record of what that value looks like came from outside shopping altogether. In 2024 the US Federal Trade Commission fined the antivirus maker Avast $16.5 million and banned it from selling browsing data for advertising, finding that software marketed as privacy protection had collected users' browsing data and sold it through a subsidiary called Jumpshot to more than a hundred third parties between 2014 and 2020 — data detailed enough, the FTC said, to reveal health concerns, political leanings and financial status.
The lesson carries directly to shopping tools: any extension with permission to read your pages is technically capable of the same trade, and the only things standing between capability and practice are the company's business model and its privacy policy. Some extensions state plainly that they collect and share browsing data. The statement tends to live deep in the policy, not on the install page.
The third model is the honest one: charge money. A subscription or a premium tier at least makes the exchange legible — you pay, you get a service, and your data does not have to be the product. Paying is not automatically safer, but it removes the structural pressure that makes the other two models drift.
How to vet a tool in a minute
Three checks, in order of speed. First, search the maker's site for a plain-language answer to "how do you make money?" — a company with a fair answer usually gives it prominently, and silence is information. Second, open the privacy policy and search the page for the words "sell" and "share"; you are looking for what happens to browsing data, and the FTC's Avast order is a reminder that the gap between marketing and policy can be wide. Third, check what control you actually have: whether you can pause the tool, and whether you can see and delete what it has learned, without emailing anyone. UK users hold a legal backstop here — the right to request a copy of the personal data any company holds on you, free, with a response due within a month — but a well-built tool should not make you use it.
If you are still mapping the wider landscape, our plain-English guide to AI shopping assistants separates the categories properly.
Where FRIDAY stands
FRIDAY is personal intelligence for shopping, and it is built so that the minute-long vetting above comes back clean. It learns your taste on your device. There are no ads and no data sale — the architecture makes the promise for us: your taste lives in an encrypted vault sealed with a key only you hold, and you can pause it any time.
We would rather be inspectable than loud. The Honey story was not really about coupons, and the Avast story was not really about antivirus; both were about what software is motivated to do with a privileged view of your browsing when nobody is looking. That is the standard every tool in this category should be held to — ours included.
