Google Play Data Safety Form Guide (2026): SDK Declarations & Privacy Policy

One of the top reasons new Android applications are rejected during closed beta and production reviews is a Data Safety Section Mismatch. Google's static analysis engine scans your compiled APK/AAB bundle, detects the third-party SDKs and network calls embedded in your code, and cross-references them against what you declared in the Play Console Data Safety questionnaire.

If your app contains an analytics or ads SDK that collects an Advertising ID (AAID) or IP address, but you marked "My app does not collect user data," your submission will be rejected with an enforcement warning. This guide explains how to properly declare your data collection practices in 2026.

1. The Golden Rules of Google Play Data Safety

To avoid compliance violations, you must understand how Google defines data collection:

• You are responsible for your SDKs: You cannot blame a third-party library. If you integrate Google Mobile Ads (AdMob), Firebase Analytics, Sentry, or OneSignal, you are legally and policy-wise responsible for every byte of data those SDKs transmit.
• "Collected" vs "Shared":
  • Collected: Data transmitted off the device to your server or a third party and stored for more than an ephemeral request.
  • Shared: Data passed to a third-party entity (e.g. ad networks or data brokers).
• Ephemeral Processing Exception: If data is processed in memory on the server and immediately discarded without being written to disk or logged (such as a weather API querying an ephemeral latitude/longitude), it does not count as collected.

2. Data Safety Mapping for Common SDKs

Use this reference table to accurately map the data collected by popular mobile frameworks and toolchains:

3. Data Encryption in Transit & Account Deletion URL

Google Play now mandates two critical disclosures for all apps that handle user data:

A. Encryption in Transit

All data transmitted between your app and external servers must utilize standard cryptographic protocols (HTTPS / TLS 1.3). If your app makes insecure plain-text HTTP calls (except for local testing), your Data Safety declaration must declare that data is not encrypted in transit, which displays a security warning to store visitors.

B. Mandatory Account and Data Deletion URL

If your application allows users to create an account, Google Play requires:

1. An in-app mechanism allowing users to delete their account and associated personal data.
2. A public web URL (e.g., https://yourdomain.com/delete-account) where users can request data deletion without needing to reinstall the app.

4. Syncing Your Data Safety Section with Your Privacy Policy

Google employs automated natural language processing (NLP) to inspect the Privacy Policy link submitted in your store listing. Ensure that:

• Your Privacy Policy explicitly mentions your legal developer name and application name.
• All third-party services used (e.g., Google Play Services, AdMob, Supabase) are listed with links to their respective privacy terms.
• The categories of data declared in the Privacy Policy match the checkboxes checked in the Play Console Data Safety questionnaire.

5. Pre-Submission Data Safety Checklist

• Declared all Advertising IDs (AAID) if any ad network or attribution library is present.
• Declared Crash Logs & Performance diagnostics if Sentry, Crashlytics, or Bugsnag are included.
• Provided a working, public Privacy Policy URL accessible worldwide without login barriers.
• Provided a valid Account Deletion URL if authentication is supported.
• Ensured closed testing testers can review the declared privacy terms during onboarding.