Why Google Play Rejected Your App: Privacy Policy Fixes

Start with the exact Google Play notice

A Google Play rejection that mentions privacy can point to several different problems. The privacy policy URL may be missing or inaccessible. The policy may not identify the app or developer. The Data safety form may not match the app and its SDKs. The app may collect sensitive data without the prominent disclosure and consent required by Google Play. An app with accounts may also be missing a compliant deletion flow.

Do not revise the policy before reading the full notice in Play Console. Record the policy name, the affected app version, any screenshot or timestamp, and the specific screen or data practice mentioned. That evidence helps you fix the actual issue instead of guessing.

1. Verify the privacy policy URL and page

Google Play's User Data policy says every app must provide a privacy policy link in Play Console and a privacy policy link or text inside the app. The public URL must be active, accessible without geographic restrictions, non-editable by visitors, and not a PDF.

Check the following before resubmitting:

• The URL loads without authentication, redirects, certificate errors, or a consent wall that blocks the page.
• The page is clearly labeled as a privacy policy.
• The developer or company named in the Play listing appears in the policy, or the app itself is named.
• A privacy contact or inquiry method is available.
• The same page can be opened from a clear location inside the app.

If you need an app-specific starting structure, compare your page with PolicyForge's Android app privacy policy guide. Treat the guide as a checklist, then confirm every statement against the shipped app.

2. Reconcile the policy with the Data safety form

Google requires developers to complete and maintain an accurate Data safety section for each app. The disclosures must cover collection, use, and sharing by the app, including behavior introduced by third-party SDKs. Where relevant, the Data safety answers must be consistent with the privacy policy.

Create one working data inventory with a row for each data type. Include the source, purpose, recipient, retention rule, security treatment, deletion behavior, and the feature or SDK responsible. Then compare that inventory with all three surfaces:

1. The current production build and its SDK configuration.
2. The Play Console Data safety answers.
3. The public privacy policy and any in-app disclosures.

Common gaps involve identifiers, diagnostics, analytics events, precise or approximate location, contacts, files, advertising data, authentication providers, and data sent to an external AI service. Policy wording cannot repair an inaccurate Data safety form, and the form cannot repair undisclosed app behavior.

3. Audit every SDK and service provider

Google makes the developer responsible for third-party code used in the app. List every analytics, advertising, crash reporting, authentication, payment, messaging, mapping, and AI SDK. Review its current documentation and the configuration used in the submitted build.

Do not assume an SDK's default behavior matches your intended use. Check whether a setting enables advertising, precise location, background collection, cross-app identifiers, model improvement, or additional event capture. Remove an SDK or disable a feature when its behavior cannot be reconciled with Google Play policy and your disclosures.

For help naming the information involved, use the personal data guide. If an app sends user inputs to an AI provider, also review the AI privacy disclosure guide.

4. Check prominent disclosure and consent

A privacy policy is not a substitute for an in-app disclosure when personal or sensitive data collection may be outside a user's reasonable expectation. Google's policy says the disclosure must appear during normal use, describe the data and how it will be used or shared, and appear before the related consent or runtime permission request.

The consent action must be clear and affirmative. Leaving a screen, pressing the back button, or allowing a notice to disappear does not count as consent. Test the full sequence on a clean install so cached permissions do not hide a broken first-run experience.

5. Verify account deletion

If users can create an account inside the app, Google Play requires a discoverable way to request deletion inside the app and through an external web resource. Deleting the account must also delete associated user data, subject to legitimate retention requirements that are clearly disclosed. Freezing or deactivating an account is not the same as deletion.

Test the external deletion URL, the in-app path, identity verification, confirmation message, backend workflow, vendor deletion calls, and any retained data. The privacy policy should explain what is deleted, what may be retained, why it is retained, and for how long.

What the privacy policy should cover

Google's policy identifies several core items. Your final wording should reflect the app rather than copy a generic list:

• The app and responsible developer or company.
• The user and device data accessed, collected, used, or shared.
• The purposes for each material processing activity.
• The categories of parties receiving personal or sensitive data.
• Security practices for sensitive data.
• Retention and deletion practices.
• A privacy contact or request mechanism.

PolicyForge's privacy policy generator can help organize these disclosures. The output still needs to be reviewed against the data inventory, SDK configuration, Data safety form, and actual deletion flow before publication.

Resubmission checklist

1. Reproduce and document the issue identified by Google.
2. Update the app or configuration that caused the mismatch.
3. Update the Data safety form and privacy policy from the same data inventory.
4. Test the policy URL from a signed-out mobile browser.
5. Test in-app disclosure, permission, consent, and deletion flows on a clean install.
6. Confirm the submitted build contains the reviewed SDK versions and settings.
7. Respond to the Play Console notice with a concise description of what changed and where reviewers can verify it.

This article addresses Google Play privacy requirements, not every legal obligation that may apply to an app. Requirements vary with the data, audience, features, and countries involved.

Primary sources

• Google Play User Data policy
• Google Play Data safety guidance
• Google Play account deletion requirements