Google Data Safety form accuracy

Google Play enforces Data Safety form accuracy through ongoing policy reviews and user reports, not just initial submission. A mismatch between what your code collects and what the form declares is grounds for a policy strike and app removal under GDPR Art.13 and CCPA §1798.100 disclosure obligations. Common misses: apps that initialise AdMob or react-native-firebase without declaring device ID sharing with Google, or crash reporters left undeclared because they feel like infrastructure rather than data collection. Google distinguishes between data you collect and data third-party SDKs collect on your behalf — both must be declared.

Walk through Play Console → App content → Data safety and map every SDK initialisation in your code to its declared data types. For Google's own SDKs, use Google's published Data Safety disclosures. For third-party SDKs, check their documentation.

When in doubt about whether an SDK shares data, mark it as shared — false negatives carry greater risk than over-disclosure. After updating, use the Play Console Preview to confirm declarations look correct before publishing. If you use fastlane, store declarations under fastlane/metadata/android/ and review them before every release.