This is broader than the Data Safety form's accuracy: it requires a posted privacy policy link, limits data collection to what's necessary for the app's function, prohibits selling data to third parties, and requires reasonable security around how collected data is stored and transmitted.
A common cause is a valid Data Safety form paired with a privacy policy link that's broken, outdated, or doesn't actually describe the data practices in enough detail to satisfy the policy's own requirements.
"Your app's privacy policy is missing, inaccessible, or does not adequately disclose how user data is collected, used, and shared, per the User Data policy."
Google's user-data policy goes beyond the accuracy of the Data Safety form. It requires a posted privacy-policy link, limits collection to what the app needs to function, prohibits selling user data and requires reasonable security for how data is stored and sent. A common problem is a valid Data Safety form paired with a privacy-policy link that is broken, outdated or too vague.
Personal data can be misused or exposed in ways that affect people long after they stop using an app. The policy sets baseline expectations for transparency, minimisation and security so that users can understand what happens to their information. It also gives Google a consistent standard to apply when privacy complaints or incidents arise, rather than depending on each developer's own interpretation.
In Play Console and within the app where required.
It needs to describe the data practices clearly enough to satisfy the policy.
Selling personal user data is prohibited.
Platform rules change often. This page is a plain-language explanation written by AppReviewFix, not official guidance. Check the current Google Play Developer Policy Center for the exact wording.