App privacy label/permissions summary visible on app store

Apple Privacy Nutrition Labels (introduced iOS 14) and Google Play Data Safety (required since 2022) are public-facing disclosures that users read before installing. A privacy label that lists a permission the app does not use — or omits a permission the app does use — is a misrepresentation that App Store and Play Store reviewers actively check. Under GDPR Art. 13, the information provided to users must be accurate and complete at the time of collection; a label that claims the app does not access location while the app requests location permission is a false disclosure. Google Play explicitly states that apps with inaccurate Data Safety forms may have their updates rejected or listings suspended. Phantom permissions (declared but unused) also appear on the store listing and reduce install conversion.

Cross-reference your app.json permissions array, ios/PrivacyInfo.xcprivacy, and your Google Play Data Safety form against the list of permissions actively used in code. Remove any permission not tied to an active feature.

{
  "expo": {
    "ios": {
      "infoPlist": {
        "NSCameraUsageDescription": "Video calls require camera access",
        "NSMicrophoneUsageDescription": "Voice and video calls require microphone access"
      }
    },
    "android": {
      "permissions": [
        "android.permission.CAMERA",
        "android.permission.RECORD_AUDIO"
      ]
    }
  }
}

For the Google Play Data Safety form, use the Data Safety section guide to enumerate data types per SDK. Update both the form and your ios/PrivacyInfo.xcprivacy every time you add or remove an SDK that accesses user data. A mismatch between the manifest and the form is the most common Data Safety rejection cause.