App Store Privacy Labels and Google Play Data Safety

What the labels are

Apple's App privacy details page explains that on each app's product page, "users can learn about some of the data types the app may collect, and whether that data is linked to them or used to track them." You must provide this information, "including the practices of third-party partners whose code you integrate into your app", and it "is required to submit new apps and app updates to the App Store."

Google's Data safety help page describes its version as a way for developers "to show users if and how they collect, share, and protect user data, before users install an app." Every app published on Google Play must complete the form, including apps on closed, open or production testing tracks. Apps that are only on the internal testing track are exempt. An app that collects nothing still has to fill in the form and link a privacy policy.

The labels are a summary, not a replacement for a privacy policy. Apple requires a privacy policy link for every app, and Google requires one to complete the form. Our guide to website privacy basics covers what a privacy policy should say.

What counts as collecting data

• Leaving the device. Apple says "Collect" means "transmitting data off the device" in a way that lets you or your partners access it for longer than it takes to service the request. Google says it "means transmitting data from your app off a user's device." Data that stays on the phone and is processed there does not count on either store.
• Every purpose, not just ads. Apple notes that "even if you collect the data for reasons other than analytics or advertising, it still needs to be declared."
• Short-lived requests. Apple does not need you to disclose data sent to service a request and not kept, such as an IP address on a server call. Google calls this ephemeral processing: you still include it in your form, but if it meets Google's standard it is not shown on the listing. Building advertising or other user profiles never counts as ephemeral.
• Web views. Data collected through a web view you control must be declared on both stores. Letting people browse the open web does not count.

Apple: App Privacy details

In App Store Connect you go through Apple's list of data types and say which ones you or your partners collect. For each type you then answer three questions.

• How is it used? The purposes are Third-Party Advertising, Developer's Advertising or Marketing, Analytics, Product Personalization, App Functionality and Other Purposes. One data type can have several.
• Is it linked to the user? Data is linked unless you strip identifiers or otherwise de-identify it before collection, and do not try to link it back afterwards. Apple adds that personal information and personal data as defined under privacy laws "are considered linked to the user."
• Is it used for tracking? Apple defines tracking as linking data from your app with data from other companies' apps, websites or offline properties for targeted advertising or advertising measurement, or sharing it with a data broker. An SDK in your app that combines your users' data with other developers' data for ad targeting counts, "even if you don't use the SDK for these purposes."

Some data is optional to disclose, but only if it meets every condition Apple lists, for example data from an optional feedback form that is not part of the app's main purpose and is not used for tracking or advertising. Apple is clear that if a data type meets some but not all of the criteria, it must be disclosed.

Apple also covers edge cases: stored IP addresses are declared by how you use them, and precise location coarsened before storage is Coarse Location. App Review Guideline 5.1.1 requires a privacy policy link in App Store Connect and inside the app, and says that if your app supports account creation, "you must also offer account deletion within the app."

Google Play: the Data safety form

You complete the form on the App content page in Play Console. It asks about collection and sharing for a list of data types, such as approximate and precise location, personal info, app activity, crash logs and diagnostics, and device or other IDs, and the purposes for each one.

Google separates collecting from sharing. "Sharing" means transferring user data collected from your app to a third party, including through SDKs in the app. Some transfers do not count as sharing: to a service provider that processes the data on your behalf, for legal purposes, when the user starts the action and expects the data to be shared, and data that has been fully anonymized. You also say whether each data type is optional or required. You can only call it optional if every user, on every device and in every region, can choose not to provide it.

The form also covers security practices, such as whether data is encrypted in transit and whether users can ask for their data to be deleted. Under Google's account deletion requirements, an app that lets people create an account must offer an in-app path to delete the account and its data, and a web link where people can request deletion. You remain responsible: "You alone are responsible for making complete and accurate declarations". If Google finds your app's behaviour does not match the declaration, it "may take appropriate action, including enforcement action."

Third-party SDKs

Analytics, crash reporting, advertising and sign-in SDKs send data that is easy to overlook, and both stores put it on you. Apple's third-party SDK requirements say "you are responsible for all the code the SDK includes in your app". Google says you "must reflect data collection or sharing carried out by such third-party code in the Data safety form for your app."

In practice, list every SDK in the app, including ones that come in with a framework such as Flutter or React Native plugins. For each, read the provider's own disclosure guidance. Google suggests checking the Google Play SDK Index to see whether your provider has published Data safety guidance. Then check the SDK's settings, which can change what it sends. Our guide to measuring a mobile app covers analytics, consent and App Tracking Transparency in more detail.

Apple privacy manifests

Apple's privacy manifest is a property list file named PrivacyInfo.xcprivacy that an app or SDK includes. It records the types of data collected and the "required reasons APIs" the code uses, and whether it tracks, with a list of tracking domains. When you prepare to distribute your app, Xcode combines the manifests of all the SDKs in it into one report, which Apple says makes it easier to create accurate Privacy Nutrition Labels.

Two rules make manifests more than a convenience. First, Apple publishes a list of commonly used SDKs, including several Firebase, Facebook and Flutter components, for which a privacy manifest is required when you submit a new app or add one of them in an update. Signatures are also required where those SDKs are used as binary dependencies. Second, certain APIs that could be misused to identify a device, which Apple calls fingerprinting, need an approved reason declared in the manifest. Apple states that "Regardless of whether a user gives your app permission to track, fingerprinting is not allowed," and that from 1 May 2024, apps that use required reason APIs without describing the reason "aren't accepted by App Store Connect."

Keeping the labels current

A label can be correct at launch and wrong six months later. A new feature or SDK update can change what the app collects. Apple says "You're responsible for keeping your responses accurate and up to date," and that you can update your answers at any time without submitting an app update. Google's form can be exported to a CSV file and imported again, which makes it easier to keep a copy with the project and compare it after changes.

A simple habit works: keep a short data inventory next to the code, listing each data type, where it goes and why. Review it whenever a feature or SDK changes, and before each release. Then update both stores' answers if anything has changed. Our guide to publishing on the App Store and Google Play covers the rest of the submission steps, and mobile app maintenance covers SDK and store deadlines.

A checklist

• Every data type the app or its SDKs send off the device is listed, with where it goes and why.
• Each type has its purposes, whether it is linked to the user, and whether it is used for tracking (Apple) or shared (Google).
• Every SDK has been checked against its provider's guidance and its actual settings.
• The iOS app and its SDKs include privacy manifests, with reasons for any required reason APIs.
• A privacy policy is linked in App Store Connect, in Play Console and inside the app, and it matches the labels.
• If users can create an account, they can delete it in the app, and on Android also through a web link.
• The answers are reviewed before each release and whenever an SDK or feature changes.

Frequently asked questions

Do we need a privacy label if our app collects no data?

Yes. Apple requires App Privacy answers for every new app and update, and Google requires every app on Google Play to complete the Data safety form and link a privacy policy, even if it collects or shares no user data. The answers can then say that no data is collected.

Do we have to declare data collected by SDKs such as analytics or crash reporting?

Yes. Both stores count data sent off the device by third-party SDKs in your app as your collection. Apple says you are responsible for all the code an SDK includes in your app, and Google says you must reflect third-party code in your Data safety form.

Does data that stays on the phone count?

No. Data that is only processed on the device and never sent off it is not collected for either store's purposes. If you derive something from it and send that off the device, Apple says to consider the result separately.

Do we need to release an app update to change our Apple privacy label?

No. Apple says you can update your App Privacy answers in App Store Connect at any time without submitting an app update. Google's Data safety form is also changed in Play Console.

What is PrivacyInfo.xcprivacy?

It is Apple's privacy manifest file. An app or SDK uses it to record the data it collects, whether it tracks, and the reasons it uses certain APIs. Xcode combines the manifests in an app into a privacy report that helps you complete the label.

Planning an app or improving one you already have? We build iPhone and Android apps together with the backend, API and admin dashboard behind them. See our mobile app development service and all our services, or email [email protected].