1. Google clarified on July 15, 2026 that its User Data requirements apply to third-party AI integrations - calling an external model API, agent SDK, chatbot service, or AI analytics vendor does NOT transfer your compliance responsibility to the provider. 2. Disclosure: both your privacy policy and the Play Data Safety form must state that user data (messages, photos, documents, voice recordings) is sent to a third-party model provider - a Data Safety form listing only your own backend is now non-compliant for AI-integrated apps. 3. Consent: users must agree BEFORE the data transfer happens - an onboarding checkbox buried in the Terms of Service is a pattern reviewers reject; implement an explicit consent gate before the first outbound call. 4. Limited use: data may only be used for the declared purpose - sending support-ticket text to a model for summarization is a declared purpose, but retaining that text to fine-tune an undisclosed feature is not. 5. Audit every outbound call to a model endpoint, including calls hidden inside third-party SDKs - an analytics or support SDK that quietly routes content through a model provider still counts as your AI integration and you remain responsible for it. 6. Build a data-flow map: input collected, vendor receiving it, purpose, user disclosure, consent basis, retention period, access controls, and deletion route - then reconcile it with your privacy policy and Data Safety answers. 7. Google frames this as a clarification (enforcement standards remain the same), but reviewers apply it from the day it publishes - treat it as effective now, not as a future deadline, and include AI data flows in your next compliance review and re-submission.