It must include data collected or handled by third-party libraries and SDKs in your app. Google's help page says data sent off the device by an SDK counts as collection, whether it goes to you or a third party, and that you alone are responsible for complete and accurate declarations.
What the form asks
Per Google, developers with an app on Google Play must complete the form for apps on closed, open or production tracks. Apps active only on internal testing tracks are exempt. You disclose:
- the user data types collected or shared,
- the purposes,
- whether each is required or optional,
- security practices such as encryption in transit and deletion requests,
- a privacy policy link, even if you collect nothing.
Google reviews the form during app review, but the page says the review is not designed to verify accuracy. Inaccurate declarations can lead to required fixes and enforcement such as blocked updates or removal.
Where SDKs come in
Google says the disclosure extends to data collected and handled through any third-party libraries or SDKs. So the form answer depends on your dependency list. A crash reporter, ad library, analytics package and login SDK each have their own collection behavior.
You can check providers' published Data safety information, including through the Google Play SDK Index. Then reflect it in your own form.
A workable process
- Export the dependency list for the release build.
- Mark each SDK that talks to a network or reads device or user data.
- Read each provider's data documentation.
- Map each data type to the form categories.
- Compare the result with the last release's form. Flag any new SDK.
- Keep a dated copy of the evidence with the release.
Where teams go wrong
| Mistake | Why it happens |
|---|---|
| Missing a transitive SDK | Only direct dependencies were listed |
| Copying last year's form | An update added a new collection path |
| Trusting an SDK's marketing page | It differs from what the code sends |
| Forgetting configuration | A setting turns collection on or off |
You can only get step four right if step one is complete, which is why the dependency inventory matters more than the form template.
Related reading
For the privacy side of SDK consent, see our post on mobile SDK privacy and consent. For the people and process side, see third party SDK and subprocessor inventory for privacy.
Quick check
Does the form apply to internal testing builds?
Google says apps active only on internal testing tracks are exempt.
Can I rely on Google to catch an inaccurate form?
No. Google's page says review is not designed to verify accuracy, and you alone are responsible.
Safeguard covers the inventory step, listing the components in a build through dependency and SBOM scanning. It does not decide what an SDK collects, and it does not do mobile binary analysis. A free scan is available.
Sources
Last reviewed: 19 October 2026.
