Volvo tried at one point.

It is possible that any developer could just say “none” even if the extension does collect data? If it has to be manually disclosed, this won’t stop malicious actors. Only trustworthy extension developers would disclose this.

I don’t host my media outside my local network but, if I did, I would use my go to method of SWAG with Authentik. This is what I have done for my other self-hosted items.