The Google Play Data safety section: get it right, then use it to convert.
Users see your Data safety section before they install, and Google can block updates if it's wrong. Most teams fill it in once and forget it. It deserves more care than that.
For a privacy-conscious user, the Data safety section is the most important part of your listing. For Google, it is a declaration you will be held to.
What the section shows
The form you complete in Play Console generates a section on your store listing showing what data your app collects and shares, and its security practices, before anyone installs.
Collection vs sharing
| Term | Means | Watch out for |
|---|---|---|
| Collected | Data leaves the user's device | Data sent by SDKs and by webviews your app controls counts |
| Shared | Collected data is transferred to a third party | Exceptions include service providers acting for you, legal obligations and user-initiated transfers |
| Out of scope | On-device-only processing; end-to-end encrypted data you can't read | Ephemeral processing is hidden on the listing but still belongs in the form |
Security practices
- Encryption in transit: declare it only if it applies to all user data your app and SDKs send off the device.
- Deletion requests: say whether users can request deletion: in the app, by form or email, or automatically within 90 days.
- Independent security review: an optional, paid badge through a Google-authorised lab, which doesn't itself verify your declarations.
Common mistakes
- Forgetting what SDKs collect: analytics, ads, crash reporting.
- Claiming encryption in transit when one endpoint still uses plain HTTP.
- Not updating after adding an SDK or feature.
- Website privacy policy and Data safety form saying different things. AI surfaces read both; see aligning your website.
- Kids apps: Families rules apply on top. See Designed for Families ASO.
Use it to convert
A short, accurate section is a selling point. If you collect little, say so in your description too ("no account needed", "no tracking"), matching the form exactly. If you need data, explain why in plain words. Then test whether that line helps in a store listing experiment.
Questions people ask
Who must complete the Google Play Data safety form?
Every developer with an app published on Google Play, including closed, open and production testing tracks, even if the app collects no user data. Internal-testing-only apps are exempt.
Does data sent by SDKs count in the Data safety section?
Yes. Data that leaves the device through SDKs or webviews your app controls counts as collected.
What happens if my Data safety section is wrong?
Developers are responsible for accuracy. If Google finds a discrepancy it may take enforcement action, including blocking updates or removing the app.
Want this mapped onto your product?
See how our ASO work runs, or send your store link and a founder will reply personally.
