Play policies: privacy, data safety and targets

Why policies?

Google Play has billions of users and must protect them from scams, malware and privacy abuse. Its Developer Program Policies set rules for every app, and apps are reviewed before and after publishing. Breaking policies can mean a rejected update, removal of the app, or even suspension of the developer account, so learn the main rules before you build.

The App content checklist

The Data safety form must match what your app and all its SDKs (analytics, ads, crash reporting) actually do. If Firebase Analytics collects device identifiers, you must declare that. Mismatches between the form and the app's behaviour are a common cause of policy warnings.

Target API level requirement

Every year Google raises the minimum targetSdk for new apps and updates, so apps adopt Android's newer privacy and security behaviour. For example, from 31 August 2025 new apps and updates had to target Android 15 (API 35). Check the current requirement on the official "target API level" page before each release, and plan time to test your app's behaviour after raising targetSdk.

Restricted permissions

Some permissions are allowed only for apps whose core purpose needs them. SMS and call log permissions are limited to apps such as default SMS or dialer apps; background location needs a strong, visible, user-facing reason. Many apps that only need an OTP can use the SMS User Consent or SMS Retriever APIs instead of reading SMS at all.

Common rejection reasons and fixes

• Missing or vague privacy policy: publish a clear page that names your app and lists the data you collect.
• Data safety form does not match behaviour: audit every SDK and update the form.
• Reviewer cannot log in: provide a demo account in App access.
• Misleading listing (fake screenshots, "No. 1 app" claims): show the real app and honest text.
• Requesting a restricted permission without qualifying: remove it or use an alternative API.
• Impersonation: using another brand's name or logo (for example a bank or government department) without permission.

Indian context

Apps that deal with loans, payments or KYC face extra scrutiny. Personal loan apps, for example, have specific Play requirements in India, including showing the regulated lender they work with. India's Digital Personal Data Protection Act, 2023 also sets duties for handling personal data. If your app touches money, identity or health data, read the relevant policies carefully and take proper legal advice.

Common mistakes

• Filling the Data safety form once and never updating it when you add an SDK.
• Copying a privacy policy from another app without changing it.
• Waiting until the deadline to raise targetSdk.
• Ignoring policy emails from Google Play: they usually have deadlines.