If you're publishing an app on the Google Play Store in 2026, you cannot ignore the Data Safety section. Google requires every developer to provide a clear, accurate declaration of what user data their app collects, how it’s shared, and how it’s secured.
Discrepancies between what you declare in the Play Console and what your app actually does is one of the top reasons apps get rejected or removed. In fact, inaccurate declarations frequently lead to the most common Google Play Console policy violations.
Here is exactly how to fill out the Data Safety section correctly so you can pass review on the first try.
1. Understand "Collection" vs. "Sharing"
The biggest mistake developers make is misunderstanding the terminology.
- Data Collection: When data leaves the user's device and goes to your servers (or a third-party server). If data is processed strictly on the device and never leaves it, you do not need to declare it as collected.
- Data Sharing: When collected data is transferred to a third party (like an ad network or a separate analytics company).
2. You Are Responsible for Third-Party SDKs
If you use Firebase Crashlytics, AdMob, Adjust, or any other third-party SDK, their data collection is your data collection.
Many developers falsely declare that their app collects no data, completely forgetting that their analytics SDK transmits device IDs, IP addresses, and crash logs off-device.
- How to fix it: Always check the Google Play SDK Index (external link). Most major SDK providers publish specific documentation telling you exactly which boxes to tick in your Data Safety form.
3. Account for 2026 Policy Updates
If you have updated your app to comply with Google's recent 2026 privacy pushes, you must update your Data Safety form to match.
- Contacts: If you migrated away from
READ_CONTACTSto the new Android Contact Picker (mandatory by October 2026 for non-core apps), you are collecting less data. Update your form to reflect this reduced scope. - Location: If you switched to the recommended "Location Button" for precise location, ensure your data safety declarations align with this new user-driven interaction.
4. The Data Deletion Requirement
Google strictly enforces the rule that users must have a "readily discoverable" way to request account and data deletion. You must provide a functional web link in the Data Safety form where users can request data deletion without having to reinstall your app. A simple email address mailto link is no longer sufficient for modern compliance.
5. Verify Compliance During Your 14-Day Closed Test
One of the best times to ensure your app behaves exactly as declared is during your mandatory closed testing phase. As your 20 testers use the app, monitor your backend and SDK dashboards to see exactly what data is being transmitted.
If you are struggling to find 20 real testers who will actually use your app daily, read our 14-day testing guide. Using a professional service like 12-App Tester guarantees that real users will test your app's flows, helping you verify that your data collection matches your declarations before Google's reviewers take a look.
Conclusion
Filling out the Data Safety section isn't just a checkbox exercise; it's a binding declaration of your app's privacy practices. When in doubt, it is always safer to over-declare the data you collect rather than under-declare and risk an app suspension.
For the most up-to-date, step-by-step instructions on filling out the form, always reference the official Play Console Help documentation.