Google cross-references your declared data collection against what reviewers can observe the app doing. Any mismatch — even one omitted data type — can trigger a rejection.
Why apps actually get flagged
Usually caused by the form not being updated after a new SDK or permission was added to the app since it was last submitted.
A real example
"Your app's Data safety section doesn't accurately reflect the data collection and sharing practices described in your app's privacy policy."
The short version, in more detail
The Data Safety form is Google Play's privacy label. A developer declares what data the app collects, what it shares and how it is protected. Play compares that declaration with what the app actually does, including the behaviour of every third-party SDK in the app. A mismatch can lead to a rejection or a policy warning even when the intention was good.
What this guideline covers
Declarations of data collected and shared, by type and by purpose.
Whether data is required or optional, and whether it is encrypted in transit.
Whether users can request deletion of their data.
The link to a privacy policy that matches the declaration.
Data collected by third-party SDKs bundled in the app, which counts as the app's own.
What usually triggers this rejection
The form says no data is collected, but an analytics, ads or crash-reporting SDK collects device or usage data.
Data shared with partners or SDKs is not declared as shared.
The privacy policy link is missing, broken or does not match the form.
The form claims data is encrypted in transit or can be deleted when that is not true.
A new version adds a data type but the form was not updated.
How reviewers evaluate it
Google combines automated analysis of the app with review of the declaration.
It looks at SDKs and behaviours in the app that imply data collection.
It compares the declared answers with the privacy policy and the store listing.
Inconsistencies are flagged during review and can also be flagged after release.
Common misunderstandings
SDK data counts. An app is responsible for what the libraries inside it collect.
The form is not a substitute for a privacy policy. Both are required and should agree.
A declaration is not set and forget. It needs attention whenever the app's data use changes.
Common questions
What if my app collects nothing?
That can be declared, but it is worth checking, since many SDKs collect device identifiers or diagnostics by default.
Is the Data Safety form public?
Yes. A summary is shown to users on the app's store listing.
Why was my update rejected over the form?
Play compares each release with its declaration, so a change in the app's data behaviour can show up as a mismatch.
Platform rules change often. This page is a plain-language explanation written by AppReviewFix, not official guidance. Check the current Google Play Developer Policy Center for the exact wording.
Got this exact rejection?Paste it in and get a diagnosis specific to your app, free.