How to Fill Out the Google Play Data Safety Form

Before you start: inventory your data

Make a table of every data flow, including SDKs:

Check each SDK’s own Data safety guidance. Most major SDK providers publish what to declare.

Key definitions (simplified)

• Collected: data leaves the device (to you or a third party).
• Shared: data is transferred to a third party. Some transfers are exempt, like service providers acting on your behalf, or transfers the user initiates. Read Google’s definitions carefully.
• Ephemeral processing and on-device-only processing may not count as collection. Again, check the definitions.

Walking through the form

1. Data collection and security: does the app collect or share any required data types? Is data encrypted in transit? Can users request deletion?
2. Data types: tick each category (location, personal info, financial, messages, photos, app activity, device IDs and so on).
3. Per type: collected and/or shared, ephemeral or not, required or optional, and purposes.
4. Preview the label and submit.

Common mistakes

• Saying “no data collected” while using analytics or ads SDKs.
• Forgetting crash logs and diagnostics.
• Marking deletion as available without an actual way to request it. See account deletion link.
• A privacy policy that contradicts the form. See privacy policy guide.

When to update it

Every time you add an SDK, a permission or a feature that touches user data. Inaccurate Data safety declarations can lead to enforcement. This isn’t legal advice, so get professional review if you handle sensitive data.

Frequently asked questions