Google holds the app developer accountable for any policy violation caused by a bundled SDK — ad networks, analytics tools, crash reporters — regardless of whether the developer wrote or controls that code.
Very commonly triggered when an ad mediation SDK updates itself and starts requesting a new permission or sending data the developer never configured or reviewed.
"Your app contains an SDK that violates Google Play policy. As the app's developer, you are responsible for ensuring all SDKs used comply with policy, per the SDK Requirements."
Google holds the app developer accountable for any policy violation caused by a bundled SDK, whether it is an ad network, analytics tool or crash reporter, and whether or not the developer wrote it. A typical case is an ad mediation SDK that updates itself and starts asking for a new permission or sending data the developer never configured or reviewed.
Modern apps are largely assembled from third-party code, and users cannot see which libraries are inside an app. Because the developer chooses and ships each component, Google treats them as part of the app. The policy encourages developers to know what their dependencies do and to keep control over updates, since a change in a library can alter privacy and safety without a single line of the developer's own code changing.
Vendor documentation and data-safety guidance usually describe it, and testing can confirm it.
It identifies problematic versions and can notify affected developers.
Yes. SDK data counts as the app's data in that form.
Platform rules change often. This page is a plain-language explanation written by AppReviewFix, not official guidance. Check the current Google Play Developer Policy Center for the exact wording.