Privacy policy for an Android app: Google Play requirements

Google Play asks every app, without exception, for a link to a privacy policy. The policy is not reviewed alone: Google compares it with your Data safety form, your permission declarations and what your app actually does. Most privacy rejections on Google Play are mismatches between those four. This guide sets out what Google Play's User Data policy requires and how to keep everything consistent.

Does every Google Play app need a privacy policy?

Yes. The User Data policy requires a privacy policy for all apps, including apps that do not access any personal or sensitive data. Every app must also complete the Data safety form. If your app collects nothing, both can say exactly that, in plain words.

Where do I add the privacy policy link?

In two places:

1. In Play Console, on the App content page under Policy and programs, in the Privacy policy section. The same link appears on your store listing.
2. Inside the app, as a link or the full text, somewhere users can find it, such as Settings or About.

The page itself must be public, reachable from every country, not editable by visitors, clearly titled as a privacy policy, and not a PDF. It must name the app or the developer exactly as they appear on your store listing.

What must the policy say for Google Play?

The User Data policy lists the content Google expects:

• Who you are, and a privacy contact or a way to send privacy questions.
• The types of personal and sensitive user data your app accesses, collects, uses and shares, including through SDKs.
• The types of parties you share data with.
• How you handle data securely.
• Your data retention and deletion policy.

Google also requires that personal and sensitive data be sent with modern encryption, such as HTTPS, that it be used only for purposes you disclose, and that it never be sold.

How does the Data safety form relate to the policy?

The Data safety form produces the "Data safety" section on your store listing. It asks which data types your app collects and shares, why, whether collection is optional, whether data is encrypted in transit, and whether users can ask for deletion. Google's definitions matter:

• Collection means sending data off the device. Data processed only on the device is not collected.
• Sharing means transferring data to a third party. Sending data to a service provider that processes it on your behalf is not sharing, but it is still collection.
• Data collected by SDKs inside your app counts as your app's collection.

The form and the policy must agree. If your form says you collect crash logs, your policy should mention crash reports; if your policy says you collect nothing, the form should too. Check both every time you add an SDK.

When do I need a prominent disclosure?

If your app collects personal or sensitive data in a way users might not expect, Google requires an in-app disclosure before asking for consent. It must appear in the normal flow of the app, describe the data and how it is used, sit apart from unrelated text, and require a clear action, such as tapping Accept. Dismissing the dialog or pressing back does not count as consent. The privacy policy alone does not satisfy this rule.

What does Google Play require for account deletion?

If users can create an account in your app, you must let them:

• Start account deletion inside the app, from a place they can find, such as account settings.
• Request deletion from a web page as well, without reinstalling the app. You enter that URL in Play Console.

Deleting means removing the account and its data; deactivating or freezing it is not enough. If you keep some data for legal, security or fraud reasons, say so in the policy. Your privacy policy can serve as the web resource if its deletion section is prominent and names the app.

What extra rules apply to permissions?

Some permissions need more than a sentence in your policy:

• Background location requires a declaration in Play Console, a short video of the feature that needs it, and an in-app disclosure.
• Health data read through Health Connect requires a declaration of each data type and its use, and cannot be used for advertising.
• SMS, call log, all-files access and the full list of installed apps are restricted to specific use cases.
• The advertising ID may be used only for advertising and analytics, and users' choices to reset it or opt out must be respected.

Whatever you declare, the policy should describe the same use.

What if my app is for children?

Apps that target children, in whole or in part, follow the Families policy. In short: your app and its SDKs must comply with laws such as COPPA and GDPR; apps aimed only at children must not send identifiers such as the advertising ID; children may only see ads from Families Self-Certified Ads SDKs, and never interest-based ones; and mixed-audience apps should use a neutral age screen. Your policy must describe what you collect from children accurately.

What gets a privacy policy rejected on Google Play?

• The link is missing, broken, behind a login, geo-blocked or a PDF.
• The page does not name the app or the developer from the listing.
• The policy and the Data safety form disagree.
• An SDK collects data the policy does not mention.
• A sensitive permission is used without the disclosure or declaration.
• There is no account deletion path.

How do I get a compliant policy quickly?

Answer the questions in the app privacy policy generator. It covers each item above, links to the policy of every SDK you select, and includes in-app and web deletion wording. Then fill in the Data safety form with the same answers. For the full picture across both stores, see the app privacy policy guide, and for iOS, the App Store requirements.