Every app published on Google Play — including apps still in closed, open, or production testing — must complete the Data safety form in Play Console. It is one of the most common sources of submission friction in 2026, yet most of it is avoidable: the requirements are published, and the mistakes are repetitive. This tutorial walks through who must complete the form, what you actually need to disclose, what is exempt, and the exact Play Console steps to fill and submit it correctly.
1. Do you even need to complete it?
Google's rule is broad: all developers with an app published on Google Play must complete the Data safety form, including apps on closed, open, or production testing tracks, and pregranted or preloaded apps that update through Google Play. That means the form is not something you do after launch — it is part of the submission pipeline.
- Exempt: apps active only on internal testing tracks do not need to complete it, and neither do system services or private apps.
- Zero-data apps still must fill it out: even if your app collects no user data at all, you must complete the form and provide a privacy policy link — the form itself can simply state that nothing is collected or shared.
2. What you need before you start
Before opening the form, gather three things: a privacy policy that is live and linked from your store listing (required to complete the form), a list of your app's declared permissions and the APIs it uses, and an honest audit of every third-party library or SDK inside your app. Google explicitly warns that data collection carried out by third-party code must be reflected in your form — "it's your responsibility to ensure that any such code used in your app is compliant with Play Developer Program policies." Your SDK providers often publish their own Data safety guidance; review it rather than guessing.
3. What counts as "collection" — and what doesn't
The form's definitions matter more than most developers expect. Per Google's official guidance:
- "Collect" means transmitting data off the user's device. It includes data sent by libraries and SDKs, and data collected from a webview opened from your app — as long as your app controls the code or behavior delivered through that webview. Navigating the open web in a webview is not collection.
- Ephemeral processing: data transmitted off-device but used only in memory for a specific real-time request can be answered in the form but is not disclosed on the store listing. The catch: building advertising profiles or other user profiles can never be treated as ephemeral.
- Pseudonymous data must be disclosed — anything that can reasonably be re-associated with a user counts.
- Not in scope: data processed only on-device, and data protected by end-to-end encryption where neither you nor any intermediary can read it.
What counts as "sharing"
Sharing means transferring user data to a third party — including server-to-server transfers, on-device transfer to another app, and transfers via your SDKs or webviews. Some transfers are not sharing and need no disclosure: transfers to a service provider processing data on your behalf, transfers for legal purposes, transfers based on a specific user-initiated action or prominent in-app disclosure with consent, and fully anonymized data.
4. Data types and purposes you must declare
The form asks you to select every applicable user data type, then answer usage questions for each. The data type list includes: location, personal info, financial info, health and fitness, messages, photos and videos, audio files, files and docs, calendar, contacts, app activity, web browsing, app info and performance, and device or other IDs (IMEI, MAC address, advertising ID, Firebase installation ID, and similar).
For each data type, you then select the purposes: app functionality, analytics, developer communications, advertising or marketing, fraud prevention/security/compliance, personalization, and account management — separately for collection and for sharing. You also declare whether each data type is required for the app or optional (users can opt in/out or use the app without it), and whether the data is encrypted in transit.
5. The step-by-step in Play Console
The official flow is:
- Open Play Console and go to the App content page.
- Under "Data safety," select Start.
- Read the Overview section, then select Next.
- In Data collection and security, answer whether your app collects or shares any required user data types, then confirm encryption in transit and whether users can request data deletion.
- In Data types, select all applicable types, then Next.
- In Data usage and handling, answer the per-type questions (collected/shared, ephemeral, required/optional, purposes).
- Review the Store listing preview — this is exactly what users will see.
- Select Submit, or save as draft and return later. You can also export your responses to CSV, edit offline, and re-import.
6. Account deletion questions
Since 2023, the form includes data deletion questions: if your app allows users to create an account, you must provide an in-app path to delete the account and its associated data, plus a web link where users can request deletion. Incomplete answers block new submissions and updates in Play Console, and non-compliance can lead to enforcement actions. This requirement ties directly into the User Data policy — if you haven't built account deletion yet, build it before you touch the form.
7. After you submit
Your declarations are reviewed as part of the app review process. Google's review is not designed to verify the accuracy of your declarations — the responsibility is explicitly yours: "You alone are responsible for making complete and accurate declarations." When Google becomes aware of a discrepancy between your app's actual behavior and your declaration, it may take enforcement action. The practical reading: treat the form as a living document. Every time you add an SDK, a permission, or an analytics event, re-check the form before your next update.
The one-line takeaway: the Data safety form is a declaration of what your app actually does with user data — SDKs included. Audit your app, fill the form honestly before submission, and re-audit whenever your code changes. That discipline avoids the most common rejection and enforcement outcomes in 2026.