Data safety

Data safety is the declaration in Play Console, under Policy and App content, describing what data your Android app collects and shares, and it is shown to users on your store listing.

The form has two halves. First, overall practices: whether data is encrypted in transit, whether you provide a way for users to request deletion, and whether the app has had an independent security review. Second, a walk through data types, from location and personal info to financial info, messages, photos, files and device identifiers. For each one you say whether it is collected, whether it is shared with third parties, whether it is required or optional, and what it is used for.

Two distinctions cause most of the errors. Collected means it leaves the device, so on-device-only processing is not collection. Shared means it goes to another company, and that includes sending an identifier to an analytics or ads provider, which many developers do not think of as sharing.

Your dependencies count as your behaviour. An SDK collecting advertising IDs or coarse location is your declaration, and Google does compare declared behaviour against what the app does.

Keep the form, your privacy policy and the code consistent. A privacy policy that describes collection the form denies is a policy problem, and Data safety mismatches block updates rather than just earning a warning.

See also: privacy nutrition label, Play Console, target API level.