How to fill in Google Play’s Data safety form
The Data safety form, under App content in Play Console, asks whether your app and every SDK in it collect or share user data, which data types, for what purposes and how they are protected; every app on a production, open or closed testing track must complete it, even one that collects nothing, and it requires a privacy policy link.
What is the Google Play Data safety form?
It is a declaration you complete in Play Console that Google turns into the Data safety section of your store listing. Users see it before they install. Google reviews it as part of app review, but is explicit about who carries the risk: "You alone are responsible for making complete and accurate declarations in your app’s store listing on Google Play."
Who must complete it: every app on a production, open or closed testing track, including apps that collect nothing. Apps active only on the internal testing track are exempt. There is one global form per package name, and it must describe "the sum of your app’s data collection and sharing across all its versions currently distributed on Google Play."
Before you start: what to prepare
- A privacy policy on a public web page. Google lists it as required to complete the form.
- A list of your app's permissions and the APIs it uses.
- A list of every SDK and library in the build, with each provider's published Data safety guidance (many providers link theirs from the Google Play SDK Index).
- If users can create accounts: the URL of the web page where they can request account deletion.
How to fill in the form, step by step
- Open Play Console and go to the App content page.
- Under Data safety, select Start and read the Overview section, then select Next.
- Data collection and security: answer whether your app collects or shares any of the required user data types. If yes, answer whether all collected data is encrypted in transit and whether you provide a way for users to request deletion of their data.
- Data types: select every data type your app collects or shares. The categories are Location, Personal info, Financial info, Health and fitness, Messages, Photos and videos, Audio files, Files and docs, Calendar, Contacts, App activity, Web browsing, App info and performance, and Device or other IDs.
- Data usage and handling: select Start next to each data type and answer: is it collected, shared or both; is it processed ephemerally; is it required or can users choose; and why it is collected and shared. The purposes are App functionality, Analytics, Developer communications, Advertising or marketing, Fraud prevention, security, and compliance, Personalization, and Account management.
- Store listing preview: check what users will see.
- Select Submit. You can also Save as draft, or export and import the answers as a CSV file.
What counts as "collect" and what counts as "share"?
The two words have narrow definitions, and most wrong forms come from guessing them.
| Term | Google's definition | Not included |
|---|---|---|
| Collect | "Collect" means transmitting data from your app off a user’s device, including by SDKs and by webviews whose code your app controls | Data processed only on the device; data sent with end-to-end encryption that nobody but sender and recipient can read; webviews where users browse the open web |
| Share | Transferring user data collected from your app to a third party: server to server, to another app on the device, or directly through an SDK | Transfers to a service provider that processes data on your behalf; transfers for legal purposes; transfers the user initiates or consents to after a prominent disclosure; fully anonymized data |
| Ephemeral processing | Data kept only in memory and no longer than needed for a real-time request | Must still be entered in the form, but is not shown on the listing; building ad or user profiles is never ephemeral |
| Optional | Every user, in every region and on every device, can avoid providing it | If any version requires the data for any user, declare it as required |
How do I declare data collected by SDKs?
Start from what each SDK actually sends, not from its category. The table shows how the form's definitions usually apply to common SDK types; confirm the details with each provider's own Data safety guidance.
| SDK type | Data types it commonly involves | Purpose to select | Shared? |
|---|---|---|---|
| Analytics | App interactions, Device or other IDs, Diagnostics | Analytics | Google says an analytics provider that processes data "solely on your behalf" typically qualifies as a service provider, so not sharing |
| Crash reporting | Crash logs, Diagnostics, Device or other IDs | Analytics (Google's example includes diagnosing and fixing crashes) | Same service-provider test |
| Advertising | Device or other IDs (the Android advertising ID belongs here), location if inferred from the IP address, App interactions | Advertising or marketing | If the provider builds advertising profiles across multiple customers, Google says it is not service-provider activity and must be declared as sharing |
| Sign-in and accounts | Email address, Name, User IDs | Account management, App functionality | Depends on the provider's role |
| Payments | Purchase history if your app receives it | App functionality | Card numbers collected directly by Google Play's billing system or a similar payment service, which your app never accesses, need not be declared |
Two notes from Google's FAQ settle frequent arguments. Pseudonymous data must be disclosed: "if you collect diagnostic information with a device identifier, you should still disclose the collection of 'Diagnostics'." And IP addresses follow their use: if you use them to determine location, declare location.
What does the privacy policy need?
The User Data policy sets the rules, and they apply to every app:
- A link in the designated Play Console field, and a link or text inside the app.
- An "active, publicly accessible and non-geofenced URL (no PDFs)" that is non-editable.
- Clearly labelled as a privacy policy, for example in its title.
- Developer information and a privacy point of contact or a way to send inquiries.
- The types of personal and sensitive data the app accesses, collects, uses and shares, and the parties it is shared with.
- Secure data handling procedures, and your data retention and deletion policy.
- The entity named on your Google Play listing, or the app's name, must appear in the policy.
The privacy policy must be consistent with the Data safety form, and it is "not limited by the data disclosed in the Data safety section": it can and should say more.
What about the account deletion URL?
If users can create an account in your app, you must let them request deletion both inside the app and outside it, and enter the web link in Play Console. Google is explicit: "Temporary account deactivation, disabling, or 'freezing' the app account does not qualify as account deletion." The associated data must be deleted too; if you keep some for security, fraud prevention or legal reasons, say so in the privacy policy. The Data safety form includes data deletion questions for all developers.
What are the most common Data safety mistakes?
- "No data collected" with an ads, analytics or crash SDK in the build. The SDK's transmissions count as your app's collection.
- Claiming encryption in transit when one SDK or endpoint is not encrypted. Google lets you declare it only if it applies to all user data your app, "including all its SDKs and libraries", sends off the device.
- Marking data optional when sign-in or a core feature requires it.
- Forgetting old versions. The form covers every version still distributed.
- Not updating after a new SDK. Your responses "must remain accurate and complete at all times."
- A privacy policy as a PDF, behind a region block, or missing the app or developer name.
When Google finds a mismatch, it requires a fix; per its FAQ, "Apps that don’t become compliant are subject to policy enforcement, like blocked updates or removal from Google Play." See the rejection reasons guide for the resubmission steps and the suspension guide if it goes further.
How does it map to Apple's App Privacy details?
Reuse your data inventory, not your answers. Google warns that its taxonomy "may differ materially from those used in other app stores."
| Point | Google Play Data safety | App Store privacy details |
|---|---|---|
| Where | App content page in Play Console | App Store Connect |
| Meaning of "collect" | Transmitting data off the device | Transmitting data off the device so that you or partners can access it longer than needed to serve the request in real time |
| Third-party code | SDK data must be included | Third-party partners' data must be included |
| Key extra questions | Shared or not, ephemeral, required or optional, purposes | Whether data is linked to the user and whether it is used to track them |
| Changing answers | Update whenever practices change | Apple says you can update answers at any time without an app update |
For the App Store side of the same topic, see the guideline 5.1.1 data collection guide.
Where Uptika fits
Uptika does not fill in or check your Data safety form. It covers the listing text around it: the free Metadata Linter flags rejection risks in titles and descriptions, and on paid plans Sayfa denetimi (page audit) runs the same check on your live listing. Create an account to track your listing daily.
Questions
How do I fill out the Google Play Data safety section?
In Play Console open App content, select Start under Data safety, then answer the Data collection and security questions, select every data type your app and its SDKs collect or share, answer the usage and handling questions for each type, check the Store listing preview and submit.
Is a privacy policy required on Google Play?
Yes, for every app. The User Data policy requires a privacy policy link in the designated Play Console field and a link or text inside the app, even when the app accesses no personal and sensitive user data. The Data safety form cannot be completed without it.
Why was my Data safety form rejected?
Usually because the declared practices do not match what the app does: an SDK sends data that the form does not list, encryption in transit is claimed but not true for all data, required data is marked optional, or the privacy policy link is missing or broken. Google says apps that do not become compliant face enforcement such as blocked updates or removal.
Do I have to declare data collected by SDKs?
Yes. Collection includes data sent off the device by libraries and SDKs in your app, whether it goes to your server or a third party. Google suggests checking your SDK providers’ published Data safety guidance and the Google Play SDK Index.
Does an app that collects no data need the form?
Yes. Google states that even developers whose apps collect no user data must complete the form and provide a privacy policy link; the form and policy can then say that no data is collected or shared. Apps active only on the internal testing track are exempt.