Google Play Data Safety Form: The Complete Guide

What Is the Data Safety Form?

The Data Safety form is Google Play's equivalent of Apple's privacy labels. It is a mandatory declaration in the Google Play Console that tells users what data your app collects, shares, and how it handles security. Every app on Google Play must have a completed Data Safety form.

Users see this information on your app's Play Store listing under the "Data safety" section, allowing them to make informed decisions before installing.

What You Must Declare

The Data Safety form covers four key areas:

1. Data Collection

For each data type, you must state whether your app collects it. "Collection" means data is transmitted off the device to your servers or a third party.

2. Data Sharing

Does your app share any collected data with third parties? Third parties include analytics providers, ad networks, payment processors, and any external service that receives user data.

3. Data Handling Practices

• Is the data encrypted in transit?
• Can users request data deletion?
• Is the data collection optional or required?

4. Security Practices

• Does your app use encryption for data in transit?
• Do you follow a data retention and deletion policy?

Data Types and Categories

Google organizes data into these categories:

Category	Data Types
Location	Approximate location, precise location
Personal info	Name, email, user IDs, address, phone number
Financial info	Purchase history, credit info, other financial info
Health and fitness	Health info, fitness info
Messages	Emails, SMS/MMS, other messages
Photos and videos	Photos, videos
Audio files	Voice/sound recordings, music files
Files and docs	Files and docs
Calendar	Calendar events
Contacts	Contacts
App activity	App interactions, search history, installed apps
Web browsing	Web browsing history
App info and performance	Crash logs, diagnostics, other performance data
Device or other IDs	Device ID, advertising ID

Filling Out the Form: Step by Step

Step 1: Audit Your App

Before touching the form, conduct a thorough audit:

1. List every piece of data your app collects
2. Identify all third-party SDKs and their data practices
3. Map data flows: what goes to your servers, what goes to third parties
4. Document your security practices (encryption, retention, deletion)

Step 2: Access the Form

1. Open Google Play Console
2. Select your app
3. Navigate to "App content" then "Data safety"
4. Click "Start" or "Manage"

Step 3: Answer the Overview Questions

Google starts with high-level questions:

• Does your app collect or share any user data?
• Does your app use encryption for data in transit?
• Do you provide a way for users to request data deletion?
• Is your app a news or entertainment app that primarily deals with content?

Step 4: Declare Each Data Type

For every data type you collect, specify:

• Collection - Is this data sent off the device?
• Sharing - Is this data shared with third parties?
• Ephemeral - Is the data processed only in memory without being stored?
• Required or optional - Can the user opt out of this collection?
• Purpose - Why do you collect this data? (app functionality, analytics, advertising, fraud prevention, personalization, account management)

Step 5: Review and Submit

Preview your Data Safety section to see how it will appear to users. Make sure everything is accurate before submitting.

Third-Party SDK Data Practices

This is the trickiest part. You are responsible for declaring data collected by every SDK in your app, even if you do not directly access that data.

Common SDKs and their typical data collection:

• Firebase Analytics - App interactions, device ID, crash logs
• Google AdMob - Advertising ID, location (approximate), device info
• Facebook SDK - Device ID, app interactions, advertising data
• Crashlytics - Crash logs, device info, performance data
• OneSignal - Device ID, notification interactions

Check each SDK's documentation for their specific Data Safety guidance. Most major SDKs now provide detailed information about what they collect.

Common Mistakes

• Under-declaring - Not accounting for SDK data collection. Google checks declarations against actual behavior and may remove non-compliant apps.
• Over-declaring - Declaring data you do not collect makes your listing look worse than necessary.
• Wrong purpose classification - Labeling advertising data as "app functionality" instead of being honest about the real purpose.
• Missing data deletion - Google requires both an in-app and a web-based deletion mechanism.
• Not updating - Your form must stay current when you add SDKs, remove features, or change data practices. Review it quarterly.

Related Topics

• iOS Privacy Labels Guide
• Account Deletion Requirement
• Google Play Developer Policy