How to Publish an App on Google Play for the First Time
The whole journey for a first app: account, setup, closed testing, production access and release.
Read the guide →Google Play Data Safety Form and Privacy Policy
Quick answer The Data safety form tells Google Play users what data your app collects and shares. Every published app needs it, and your answers must match what the app really does and what your privacy policy says.
Every app on Google Play needs a privacy policy and a Data safety section, and getting them wrong can delay your release or lead to enforcement later. This guide explains what the form is, who must complete it and how to answer it correctly, using Google's own rules.
What is the Google Play Data safety form?
The Data safety section is a part of your Google Play store listing that shows users how your app collects, shares and protects data. You fill it in through the Data safety form on the App content page in Play Console. Google explains the rules on its Data safety help page.
Who must complete the Data safety form?
- All developers with apps on closed, open and production tracks.
- Apps that collect no user data. They must still complete the form and link a privacy policy.
- Not required: apps active only on internal testing tracks, system services and private apps.
A privacy policy is required to complete the form and for the data safety information to appear to users.
What you need to declare
- Data collection: data sent off the device, including by third-party libraries, SDKs and webviews you control.
- Data sharing: data transferred to third parties.
- Data handling: whether each data type is required or optional, why it is collected, whether it is encrypted in transit and whether users can ask for deletion.
- Data types: for example location, personal info, financial info, health and fitness, messages, photos and videos, contacts, app activity and device IDs.
Common mistakes
- Forgetting third-party SDKs. Ads, analytics and crash-reporting libraries often collect data.
- Declaring only permissions. Google says declaring a permission is not enough. Declare the data your app actually collects or shares.
- Letting the form go out of date. Update it whenever your data practices change.
- Mismatching the privacy policy. The form and policy should say the same thing.
Why it matters: Google says non-compliant apps can face enforcement, such as blocked updates or removal from Google Play.
How to complete it
- List what your app and its SDKs collectGo through each feature, library and server call.
- Publish a privacy policy pagePut it on a public URL and describe your data practices accurately.
- Open App content in Play ConsoleStart the Data safety form and answer each question.
- Review and submitCheck every answer against your policy before you send it.
Once your form is done, keep going with your first publication on Google Play. If a missing privacy policy or form causes a problem, see why apps get rejected and how to fix it.
Where developers forget to look
- Analytics tools that collect app activity or device identifiers.
- Ad networks, which often collect advertising IDs and approximate location.
- Crash reporting libraries that collect app performance data and device details.
- Login providers that collect email addresses or names.
- Webviews that you control and that send data off the device.
What your privacy policy should cover
- What data your app collects and why.
- Who the data is shared with.
- How users can ask to delete their data.
- How you keep the data secure.
- A way to contact you.
Host the policy on a stable public page, link it from the store listing and keep it in sync with your Data safety answers.
Part of a series: this article is one chapter of Google Play Closed Testing: The Complete Guide. Start there for the full roadmap from setup to production.
Examples of what to declare
These examples show the thinking, not the exact form wording. Always follow Google's current form.
| If your app... | Think about declaring |
|---|---|
| Has an AdMob banner | Device or other identifiers used for advertising, and that data is shared with the ad provider |
| Uses Firebase Analytics or Crashlytics | App activity and diagnostics collected |
| Has user accounts | Email address and any profile data you store |
| Collects nothing and has no third-party SDKs | No data collected. Check every SDK before saying so. |
Keep three things consistent
- What the app really does.
- What the Data safety form says.
- What the privacy policy says.
Mismatches between these are a common reason for review problems. See why apps get rejected.
Frequently asked questions
Do I need to complete the Data safety form if my app collects no data?
Yes. Google says apps that collect no user data must still complete the form and link a privacy policy.
Is the Data safety form needed for internal testing?
Google says apps active only on internal testing tracks are exempt. Apps on closed, open and production tracks must complete it.
Does Google check that my answers are accurate?
Google says the developer is solely responsible for complete and accurate declarations. Its review does not verify accuracy, but discrepancies may lead to enforcement.
When do I need to update the form?
Whenever your data practices change. Google says responses must stay accurate at all times.
