How to fix a Data safety mismatch
Follow these steps in order. Each one is something we do on client work.
- List every data flow. Write down each type of data the app and every SDK collects or shares: analytics, crash, ads, login, payments.
- Read your SDK docs. Most mismatches come from third-party SDKs. Check each vendor's Data safety guidance for the version you ship.
- Compare with the form. Open App content › Data safety and compare each answer with your list, including whether data is encrypted in transit and deletable.
- Fix the app or the form. If an SDK collects something you don't need, remove or configure it. Otherwise declare it accurately.
- Align the privacy policy. The policy linked in Play Console should describe the same data the form declares.
- Resubmit with a new build if code changed. Form-only fixes can be resubmitted from Play Console.
Google Play data safety: key rules and context
What the rejection means. Every app on Play must complete the Data safety section (Play Console Help). Google compares it against your app's behaviour and your privacy policy.
Why it usually happens
- Ads or analytics SDKs collect device IDs not declared.
- "No data collected" chosen for convenience.
- Privacy policy says something different from the form.
- Data shared with third parties marked as not shared.
How to fix it
- List every SDK and check its published data practices.
- Map each data type: collected, shared, optional or required, purpose.
- Update the Data safety form and privacy policy to match.
- Remove SDKs you don't need.
- Resubmit.
Appeal or resubmit? Usually a corrected form is enough. Appeal only if you can show the flagged data isn't collected.
How to avoid it next time. Add "update Data safety" to your SDK-adding checklist.
If you want this handled for you, our pricing page lists every fixed package.
Worked example (hypothetical)
This example is illustrative. The app is made up, and so are any numbers in it.
Picture a meditation app, CalmCue, that declares "no data collected" while shipping an analytics SDK and a crash reporter. Both send device identifiers. We'd update the form to declare app activity and diagnostics, mark them as collected for analytics and app functionality, state encryption in transit, and add the same wording to the privacy policy. If the team didn't need the identifier, we'd turn it off in the SDK config instead.
Google Play rules that trip most apps
These come from Play Console Help pages we checked on 26 October 2026.
| Rule | Requirement |
|---|---|
| App title | 30 characters or less; no ranking or price claims, no emojis |
| Descriptions | No repetitive or irrelevant keywords; no misleading claims like "best game ever" |
| Screenshots and video | Must reflect the app's actual experience |
| New personal accounts | Closed test with at least 12 testers opted in for at least 14 days before production |
| Icon | 512 × 512 px; no misleading symbols or ranking badges |
Common mistakes
- Answering from memory. Audit the build and SDKs, not what you think the app does.
- Forgetting SDK updates. A new SDK version can collect new data.
- A privacy policy that disagrees with the form. Reviewers compare both.
- Declaring nothing to "be safe". Under-declaring is the problem, not the fix.
Checklist
Copy this list into your release notes or ticket and tick each item off before you ship.
- Data inventory covers app and all SDKs
- SDK vendor guidance checked for shipped versions
- Form answers match the inventory
- Encryption and deletion answers verified
- Privacy policy matches the form
- Resubmitted (new build if code changed)
Sources
- Google Play Console Help: Data safety section (accessed 26 October 2026)
- Google Play Developer Policy Center (accessed 26 October 2026)
- Play Console Help: Metadata policy (accessed 26 October 2026)
- Play Console Help: App testing requirements for new personal developer accounts (accessed 26 October 2026)
- Play Console Help: Add preview assets to showcase your app (accessed 26 October 2026)
- Play Console Help: Create and set up your app (accessed 26 October 2026)
Questions
Do I need a form if I collect nothing?
Yes, you still complete it.
Do crash reports count?
Yes, if they include personal or device data.
Is Data safety the same as Apple privacy labels?
Similar idea, different questions.
Can Google remove my app?
Yes, for false declarations.
Can you audit my SDKs?
Yes, in the rejection fix package.
Do I need to declare data my SDKs collect?
Yes. Data safety covers data collected or shared by your app, including third-party libraries in it.