App Store Without a Mac

App Privacy Labels and Privacy Policies: What Apple and Google Require (2026)

What goes into Apple’s App Privacy details and Google Play’s Data safety form, what your privacy policy must say, and the account deletion rules both stores enforce.

Floot ·

Key Takeaways

  • Every app needs a privacy policy, even if it collects nothing. Apple requires a link in App Store Connect and inside the app. Google requires a link in Play Console and inside the app, at a public, non-geofenced URL that isn’t a PDF.
  • The labels cover your SDKs too. Apple says your disclosure must include data collected by third-party SDKs and analytics you integrate. Google counts data sent off the device by SDKs, libraries and webviews your app controls.
  • Apps with sign-up must offer deletion. Apple requires account deletion inside the app. Google requires a way inside the app and a web page where people can request deletion without reinstalling.
  • Neither store checks the labels for accuracy before approval. Google says its review isn’t designed to verify Data safety declarations. Errors can still lead to blocked updates or removal later.
  • Sharing with AI services now needs explicit permission on iOS. Apple’s guideline 5.1.2 says you must disclose where personal data is shared with third parties, including third-party AI, and get explicit permission first.

Quick-Start Prioritization Framework

RequirementApple App StoreGoogle Play
Store data formApp Privacy details in App Store ConnectData safety form in Play Console
Privacy policy URLRequired for all apps, plus in-app linkRequired for all apps, plus in-app link or text
Account deletionIn the app (a direct link to a web page that completes it is allowed)In the app, plus a separate web request page
Third-party SDKsInclude their data collectionInclude their collection and sharing
Tracking or adsApp Tracking Transparency prompt for trackingDeclare in Data safety; follow ad policies
Extra technical filePrivacy manifest for some SDKsNone

Both app stores ask you to describe your app’s data practices twice: once as a structured form that becomes a label on your store listing, and once as a privacy policy at a public URL. Apple calls the form App Privacy details (the “nutrition label”); Google calls it the Data safety section. Both stores also require apps with accounts to let people delete them. This guide explains each requirement from the stores’ own documentation, works through an example, and lists the mistakes that cause rejections. It is general information, not legal advice; privacy laws such as GDPR or CCPA may add obligations beyond what the stores ask.

The privacy policy both stores require

A privacy policy is a public web page explaining what data your app collects, why and what you do with it. Both stores require one for every app.

Apple’s rule (guideline 5.1.1(i))

“All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner.” Apple says the policy must clearly identify what data the app collects, how, and all uses of that data; confirm that any third party you share data with provides the same or equal protection; and explain your data retention and deletion policies and how people can revoke consent or request deletion.

Google’s rule (User Data policy)

Google’s User Data policy says “All apps must post a privacy policy link in the designated field within Play Console,” including apps that access no personal or sensitive data, and the policy must also be shown inside the app. It must be on an active, publicly accessible, non-geofenced URL, not a PDF, and not editable by others. Google lists what it must cover: developer information and a privacy contact, the types of personal data accessed, collected, used and shared and who receives it, secure handling, and retention and deletion. It must be labeled as a privacy policy and name the developer or app shown on the store listing.

Writing one that passes

The common failure is a template that doesn’t describe your actual app. Start from your Data safety and App Privacy answers and make sure the policy says the same things in plain language. If you use analytics, a payment processor, an email service or an AI provider, name the type of service and what data it receives. Put the policy at a stable URL on your own domain and link it from the app’s settings or account screen.

Apple’s App Privacy details

In App Store Connect, you answer a questionnaire about each type of data your app collects. Apple turns the answers into the privacy section of your product page. You must complete it before submitting a new app or update.

What “collect” means to Apple

Apple defines collecting as “transmitting data off the device in a way that allows you and/or your third-party partners to access it for a period longer than what is necessary to service the transmitted request in real time.” Data that never leaves the phone isn’t collected. Data your server stores, even briefly beyond the request, is.

The categories

Apple groups data into Contact Info, Health and Fitness, Financial Info, Location, Sensitive Info, Contacts, User Content, Browsing History, Search History, Identifiers, Purchases, Usage Data, Diagnostics, Surroundings, Body and Other. For each type you collect, you say what it’s used for (such as app functionality, analytics or advertising), whether it’s linked to the user’s identity, and whether it’s used for tracking.

Tracking and App Tracking Transparency

Apple defines tracking as linking data from your app with third-party data for targeted advertising or advertising measurement, or sharing data with a data broker. If your app tracks, guideline 5.1.2 requires the App Tracking Transparency permission prompt. Most small apps that use first-party analytics and no ad networks don’t track in Apple’s sense, but check every SDK you include.

Optional disclosure, narrowly

Apple lets you skip disclosing some data only when all its conditions are met: it isn’t used for tracking or advertising, it’s collected only infrequently and optionally outside the app’s main features, and the user provides it knowingly each time, such as a feedback form. Data collected on an ongoing basis after an initial permission must be disclosed.

Privacy manifests

Separately from the questionnaire, Apple uses privacy manifest files (PrivacyInfo.xcprivacy) inside the app bundle to record data collected and the reasons for using certain APIs. Apple announced that from May 1, 2024, submissions that newly add commonly used third-party SDKs need those SDKs’ privacy manifests and signatures. If you use a builder or framework, it usually handles this; check that its SDKs are up to date.

Google Play’s Data safety section

Google says all developers with an app published on Google Play must complete the Data safety form, including apps on closed, open and production tracks. Apps only on internal testing are exempt. Even if you collect nothing, you fill in the form to say so and still link a privacy policy.

Collected vs shared

Google’s definitions differ from Apple’s. “Collected” means data transmitted off the device, including by SDKs, libraries and webviews your app controls. “Shared” means data transferred to a third party. Several things don’t count as sharing: transfers to service providers that process data on your behalf, transfers for legal reasons, and transfers the user starts and would reasonably expect. Data processed only on the device, end-to-end encrypted data and anonymized data aren’t counted as collected.

Security practices and deletion

The form also asks whether data is encrypted in transit and whether users can request deletion. If your app has accounts, the Data safety section is where you give Google the web link for account deletion requests.

Google doesn’t verify it, but enforces it

Google states that its review “is not designed to verify the accuracy and completeness of your data safety declarations.” That isn’t permission to guess: if Google finds a declaration is wrong, it requires a fix, and apps that stay non-compliant can have updates blocked or be removed.

Account deletion: both stores require it

If people can create an account in your app, both stores require a way to delete it. The details differ.

AppleGoogle
Applies toApps that support account creation, including automatic guest accountsApps that let users create an account, in the app or outside it
In-app pathRequired; easy to find, usually in account settingsRequired; a prominent path such as settings (it can link to the web page)
Web pageA direct link to a page that completes deletion is allowedRequired; must work without reinstalling the app
Deactivation onlyNot enoughMust delete account and associated data
Timing and retentionDeletion may take time if you tell the user how long and confirm when doneSome data may be kept for security, fraud or legal reasons, if disclosed
Phone or email onlyNot allowed except highly regulated industriesThe web page must let users request deletion directly

Subscriptions and Sign in with Apple

Apple adds two practical points. If the user has an auto-renewing subscription through Apple, tell them billing continues until they cancel it through Apple. And if your app uses Sign in with Apple, revoke the user’s tokens using Apple’s REST API when they delete their account.

Worked example: a class booking app

Here is how one simple app might fill in both forms. Your answers depend on your exact app and its services.

The app lets members sign up with email, book classes, upload a profile photo and receive reminder notifications. It uses a payment processor for class packs and a crash reporting service.

DataApple category and purposeGoogle Data safety
Name, emailContact Info; App Functionality; linked to userPersonal info; collected; required for accounts
Profile photoUser Content; App Functionality; linkedPhotos; collected; optional
BookingsPurchases or Other User Content; App Functionality; linkedApp activity; collected
Payment detailsHandled by the processor; disclose Purchase History if you store itFinancial info; collected by the processor acting for you
Crash logsDiagnostics; App Functionality; usually not linkedApp info and performance; collected
Push tokenIdentifiers if linked to the accountDevice or other IDs; collected

And the privacy policy

The policy would say the same in plain words: what members provide and why, that a payment processor handles card details, that crash reports are used to fix bugs, how long data is kept after an account is deleted, and an email address for privacy questions. It would also be linked from the app’s account screen.

Common mistakes

These are the issues that most often lead to rejections or later warnings.

  • A privacy policy link that 404s, redirects to a homepage or is a PDF (Google doesn’t accept PDFs).
  • No privacy policy link inside the app, only in the store listing.
  • Declaring “no data collected” while using analytics or crash reporting SDKs.
  • A generic policy template that mentions none of the app’s actual data.
  • Account deletion that only deactivates, or that requires emailing support.
  • No web page for deletion requests on Google Play.
  • Sending user content to an AI service without saying so in the app and getting permission first, as Apple’s guideline 5.1.2 now requires.
  • Forgetting to update the labels when a new SDK or feature is added.

If you’d rather not do this yourself

No builder can fill in privacy answers for you, because they depend on what your app does and which services you add. What a builder can do is reduce the moving parts. Floot, for example, runs the app’s sign-up, database, file storage and email itself, so there are fewer third-party SDKs to account for, and you can ask it to add an in-app account deletion screen.

Frequently Asked Questions

Do I need a privacy policy if my app collects no data?

Yes. Apple requires a privacy policy link for all apps, and Google requires one for all apps including those that access no personal data. The policy can say that the app collects nothing.

What is Apple’s privacy nutrition label?

It’s the privacy section of your App Store product page, generated from the App Privacy details questionnaire in App Store Connect. It lists the data your app collects, whether it’s linked to the user and whether it’s used for tracking.

Is Google’s Data safety form the same as Apple’s privacy labels?

They cover similar ground but use different definitions. Google separates collected and shared data and asks about security practices and deletion; Apple asks about purpose, linking to identity and tracking. Fill in each with its own definitions.

Do I have to let users delete their account?

Yes, on both stores, if the app lets people create an account. Apple requires it inside the app; Google requires an in-app path and a web page for deletion requests.

Who is responsible for data collected by SDKs in my app?

You are, for the store disclosures. Apple says to include practices of third-party SDKs you integrate, and Google counts data collected by SDKs and libraries in your app. Apple notes you don’t have to disclose data collected by Apple itself.

Does following the store rules make my app GDPR or CCPA compliant?

Not by itself. The store requirements overlap with privacy laws but don’t replace them. This article is general information, not legal advice; check the laws that apply to your users with a qualified professional.

Sources