Why Did Google Reject My App? (Privacy Policy Issues Explained)

Why Did Google (or Apple) Reject My App? Privacy Policy Issues Explained

App store rejections for privacy policy issues remain one of the most common — and most preventable — reasons apps fail review. Google prevented over 1.75 million policy-violating apps from being published on Google Play in 2025 alone, and Apple rejected 12% of App Store submissions in early 2025 specifically for Privacy Manifest violations.

Both platforms have tightened their requirements significantly in 2025 and 2026, adding new rules around AI transparency, SDK privacy manifests, and stricter data safety disclosures. If your app was rejected, this guide explains exactly what went wrong and how to fix it.

The Most Common Privacy Policy Rejection Reasons

1. Missing or Broken Privacy Policy Link

The single most frequent cause of rejection is not providing a working privacy policy URL. Google's own pre-review checks now specifically flag broken privacy policy links before your app even reaches a human reviewer.

Reviewers check for a privacy policy URL in the app store listing, a link that actually resolves (not a 404 or "coming soon" page), and a policy accessible from within the app itself (in settings or about section).

As of January 2026, California's CCPA regulations explicitly require mobile apps to include a direct link to their privacy notice from the app settings menu — meaning an in-app link is no longer just a best practice but a legal requirement for apps with California users.

Fix: Add a working privacy policy link in three places: your app store listing, your app's settings screen, and your developer website. Test the URL from both mobile and desktop browsers before submitting.

2. Mismatch Between Privacy Policy and Data Safety Declarations

This is the number one technical reason for Play Store rejection. Your privacy policy must exactly match what you declare in Google's Data Safety section (or Apple's App Privacy labels). If your policy says you collect "email and name" but your app also collects device IDs through an analytics SDK, your submission will be flagged.

Common mismatches include third-party SDKs that collect data you didn't realize (Firebase Crashlytics collects device IDs and crash logs; ad networks collect advertising IDs), analytics tools running in the background that access location or usage data, and social login integrations that pull profile information beyond what you disclose.

Google now uses automated scanning to detect discrepancies between declared data practices and actual app behavior. Apple does the same through Privacy Manifest verification.

Fix: Audit every SDK in your app. Map each one to the data it collects, then ensure your privacy policy and your platform data safety forms list all of it.

3. Incomplete Data Disclosure

Even when your privacy policy exists and your links work, apps are rejected when the policy doesn't fully describe what data is being collected. Common oversights include not listing all data types (device IDs, crash logs, usage analytics, advertising identifiers), missing third-party service disclosures (Firebase, Google Analytics, Meta SDK, ad networks), vague language about how data is used ("we may collect certain information" instead of specifying what and why), and failing to disclose data sharing with third parties.

Your policy must specifically list every category of data your app collects, explain why it's collected, identify who it's shared with, and describe how long it's retained.

Fix: Use a generator that produces app-specific policies covering every data type and third-party SDK, then cross-reference against your actual codebase.

4. Missing AI and Automation Disclosures (New in 2025-2026)

Both platforms now require transparency when apps use AI or automated decision-making. Apple requires apps that use external AI services to include a consent modal specifying the provider and the types of data shared — before any personal data is sent. Apps using AI to generate content, give recommendations, or make automated decisions face closer scrutiny and must clearly explain how these features work.

Google has similarly increased review attention on apps with AI-powered features, particularly around data handling and user consent.

Fix: If your app uses any AI service (OpenAI, Claude, Gemini, or custom models), disclose this in your privacy policy. Specify what user data is sent to the AI provider, how responses are generated, and whether any data is used for model training.

Apple App Store: Specific Requirements

Apple requires a publicly accessible privacy policy URL linked in App Store Connect (not just an in-app page), completed App Privacy "nutrition labels" that accurately reflect your data practices, clear opt-out mechanisms for data collection, contact information for data deletion and privacy requests, specific disclosure for any use of tracking under the App Tracking Transparency (ATT) framework, SDK Privacy Manifests that declare tracking domains and required reason APIs for all third-party SDKs, and as of November 2025, explicit AI transparency disclosures if your app shares personal data with third-party AI services.

If your app uses any form of user tracking, you must implement the ATT prompt and disclose this in your privacy policy. Apps with ATT opt-in rates below 30% lose significant advertising revenue, so your privacy policy language and pre-prompt messaging directly affect your bottom line.

Apple also introduced new age ratings (13+, 16+, 18+) in July 2025, with developers required to complete updated age rating questionnaires. Apps with user-generated content must implement age-restriction mechanisms.

Key deadline: Starting April 2026, all submissions must use the iOS/iPadOS 26 SDK or later.

Google Play: Specific Requirements

Google Play requires a valid privacy policy URL in your store listing if your app accesses personal or sensitive data, a completed Data Safety section that matches your actual data practices, disclosure of all data types collected, shared, and their purposes, description of data encryption and deletion practices, and a prominent in-app disclosure before collecting sensitive data (separate from the privacy policy).

Google's enforcement in 2025 was substantial: the platform prevented over 255,000 apps from getting excessive access to sensitive user data and banned more than 80,000 developer accounts. Google's Play Policy Insights tool in Android Studio now gives developers real-time feedback during coding, flagging permissions and APIs that handle personal data before you even submit.

As of April 2025, Android ID is no longer classified as a persistent device identifier — update your privacy policy if you previously disclosed it as one.

Key detail: Google tracks developer account health across all apps. A privacy violation on one app can affect your entire account, including other published apps.

Platform-Specific Data You Must Disclose

How to Write an App-Store-Ready Privacy Policy

1. Audit your app's data collection. List every piece of data your app accesses, including data collected by third-party SDKs. Don't rely on documentation alone — scan your app binary for undeclared data collection. Google's automated tools and Apple's Privacy Manifest verification will catch discrepancies you miss.

2. Map data to purposes. For each data type, document why it's collected. Generic justifications like "to improve our services" are insufficient. Be specific: "We collect crash logs via Firebase Crashlytics to identify and fix app stability issues."

3. Identify third-party recipients. List every SDK, API, or service that receives user data. This includes analytics (Google Analytics, Mixpanel, Amplitude), crash reporting (Firebase Crashlytics, Sentry), advertising (AdMob, Meta Audience Network), authentication (Sign in with Apple, Google Sign-In), AI services (OpenAI, Anthropic), and payment processors (Stripe, RevenueCat).

4. Generate your policy. Use a generator that covers app-specific requirements including SDK disclosures, platform-specific data safety categories, and multi-jurisdiction compliance (GDPR, CCPA, CalOPPA).

5. Complete platform forms. Fill out Apple's App Privacy labels and Google's Data Safety section to exactly match your policy. Any mismatch is grounds for rejection.

6. Submit Privacy Manifests (Apple). Declare all tracking domains and required reason APIs used by your app and its SDKs. This is now a mandatory part of the submission process.

7. Test the link. Verify your privacy policy URL loads correctly from both mobile and desktop browsers. A broken link is an instant rejection.

For a broader understanding of privacy requirements, see our guides on What is GDPR? and What is CCPA?.

After Approval: Staying Compliant

App store compliance is not a one-time task. Both Apple and Google conduct periodic compliance reviews and can remove previously approved apps that fall out of compliance. Google explicitly warns that third-party SDKs can silently update and modify data behavior after your app is live — making your previously accurate data safety declarations inaccurate.

You must update your privacy policy and platform declarations whenever you add new third-party SDKs, collect new types of data, change how existing data is used or shared, expand to new markets or jurisdictions, integrate AI features or change AI service providers, or update SDKs that modify their data collection behavior.

Set a quarterly review cadence at minimum. If you ship updates frequently, audit your data practices with every release that adds or modifies third-party integrations.

Generate Your App Privacy Policy →

Last reviewed: April 2026. This article is for informational purposes and does not constitute legal advice. Platform requirements are based on publicly available Apple App Store Review Guidelines, Google Play Developer Program Policies, and enforcement reports. Consult platform documentation and a qualified attorney for advice specific to your app.