Free tool

Free Google Play Data Safety Form Generator

The generator decodes the "Invalid Data safety form" email, finds the SDKs in your Android app and writes the answers and a CSV for Play Console.

Build your form Generate Privacy Policy
  • Data safety form
  • Android SDKs
  • Play Console CSV

Build your Data safety form.

Complete 4 quick steps.

Paste your Google Play email (optional)

Paste the "Issue found: Invalid Data safety form" email or the message from the Policy status page in Play Console. The generator picks out the flagged data types, version codes and SDKs.

Detect the SDKs in your app

Paste your build.gradle(.kts), libs.versions.toml, the output of ./gradlew :app:dependencies, pubspec.yaml (Flutter), package.json (React Native) or AndroidManifest.xml. To pick SDKs by hand, open the Choose SDKs tab.

Tell us what your app does

Select what your own code does. Count only data that leaves the device (sent to your server or to a third party). You don't declare data that the app processes only on the device.

My app (not counting the SDKs above)
Security and data deletion

A web page where users ask you to delete their account and its data, without reinstalling the app.

Store listing preview

How your Data safety section looks on Google Play.

Review and download

These are the answers to enter in Play Console > App content > Data safety. Review every row: you are responsible for what you declare.

This tool provides suggestions based on publicly available SDK disclosures and your answers. It's not legal advice and it doesn't analyze your app's code or network traffic. SDK behavior changes between versions and depends on how you configure it. You are solely responsible for the accuracy of your Data safety form.

How to fix the "Invalid Data safety form" error.

Google detected user data leaving your app that your Data safety form doesn't declare. In most cases a third-party SDK sends that data, not your own code.

  1. Read the email carefully. It lists the version code, the data type (for example Device or other IDs) and sometimes the SDK that Google believes sent the data.

  2. Find every SDK in your app. Google holds you responsible for data collected by any library you bundle, even features you never call.

  3. Choose a fix: either declare the data type in your Data safety form, or remove the code or SDK that sends it (for example, remove the AD_ID permission if you don't use ads).

  4. Update the form in Play Console under Policy and programs > App content > Data safety, or import the CSV generated above.

  5. Replace every non-compliant build. After a code change, upload a new release with a higher version code to every track that still serves the old one, including internal, closed and open testing tracks. Roll out to 100%.

  6. Update your Privacy Policy so it describes the same data and third parties as your Data safety form.

  7. Send the changes for review from the Publishing overview page.

How to import the CSV into Play Console.

  1. Open Play Console and select your app.

  2. Go to Policy and programs > App content, then select Data safety and click Start (or Manage).

  3. Click Import from CSV at the top right and upload the file. Importing overwrites any answers already in the form.

  4. Step through every page of the form, check each answer and click Save.

  5. Go to Publishing overview and send the changes to Google for review.

Rejections

Common Data safety rejections explained.

The data type named in your Google Play email usually points to one of these causes.

Data types flagged in the Google Play email, with the most common cause and the fix for each.
Flagged in the email Most common cause How to fix it
Device or other IDs Ad SDKs (AdMob, AppLovin, Unity Ads), Firebase Analytics, attribution SDKs (Adjust, AppsFlyer), push SDKs (OneSignal) or any code reading ANDROID_ID or the Advertising ID. Declare Device or other IDs as collected (and shared, for ad and attribution SDKs), or remove the SDK. Removing the com.google.android.gms.permission.AD_ID permission stops the Advertising ID being read.
Approximate location / Precise location Ad networks that estimate location from the IP address, or your app requesting location permissions and sending coordinates to a server. Declare the location type that matches the permission you request. Don't declare precise location if you only request ACCESS_COARSE_LOCATION.
App activity: Installed apps An SDK (often an ad or anti-fraud SDK) or your code querying the list of installed packages and sending it off the device. Declare Installed apps, or remove the SDK. Then check whether your app needs the QUERY_ALL_PACKAGES permission at all.
App activity: App interactions Analytics SDKs such as Firebase Analytics, Mixpanel or Amplitude, and most ad SDKs. Declare App interactions as collected for Analytics (and Advertising or marketing if an ad SDK uses it).
App info and performance: Crash logs / Diagnostics Crash reporting SDKs such as Firebase Crashlytics, Sentry or Bugsnag. Most ad SDKs send diagnostics too. Declare Crash logs and Diagnostics as collected for Analytics or App functionality.
Personal info: Email address / User IDs Login, sign-up or newsletter features, or SDKs where you call setUserId() or pass an email (push, support chat, analytics). Declare the personal info for Account management or App functionality, and make sure you provide an account deletion URL.
Invalid Privacy Policy The Privacy Policy link is broken, isn't a public web page, or doesn't describe the data you declare in the Data safety form. Publish a Privacy Policy that names the data types and third-party SDKs from your form, and link it in Play Console.
Data deletion questions Your app lets users create an account, but you didn't provide a working web link for account deletion requests. Add an account deletion page on your website and enter its URL in the Data deletion section of the form.

Privacy Policy Generator

Your Privacy Policy must match your Data safety form.

Google compares your Data safety answers with your Privacy Policy. A form that declares data types or third parties your Privacy Policy doesn't mention is grounds for another rejection. Generate a Privacy Policy for your Android app that covers the SDKs you use.

Generate Privacy Policy

Frequently asked questions.

Answers to the most common questions about the Google Play Data safety form.

What does "Invalid Data safety form" mean?

It means Google detected your app sending user data off the device, and your Data safety form doesn't declare that data as collected.

The email names the data type (for example Device or other IDs) and the version code where it was detected. Google won't approve new updates until the form matches what the app does.

My app doesn't collect any data. Why was it rejected?

A third-party SDK is almost always the reason. Ad networks, analytics, crash reporting, push notifications and even map libraries send device identifiers or diagnostics to their servers.

Google counts any data an SDK in your app sends off the device as data your app collects, even data you never use yourself.

What's the difference between "collected" and "shared"?

Collected means the data leaves the device and goes to you or to an SDK provider.

Shared means the data is transferred to a third party. Data sent to a service provider that processes it only on your behalf (for example, a crash reporting service) doesn't count as sharing. Data that an ad network uses for its own purposes does.

Do I need to declare data that's processed ephemerally?

Yes, you still declare ephemeral data (used only in memory and kept no longer than needed for a real-time request) as collected. Mark it as processed ephemerally, and Google Play leaves it off your store listing.

Which version code is the problem?

The email lists the version code where Google found the issue. That build sometimes stays active in a testing track (internal, closed or open testing) even when production uses a newer one.

Every active build in every track must match your Data safety form. Upload a compliant build with a higher version code to each affected track.

Does Google check my Data safety form against my Privacy Policy?

Yes. Your Privacy Policy must be a public, working web page, and it must describe the same data collection and sharing that you declare in your Data safety form.

Is this Data Safety Form Generator free?

Yes, the Google Play Data Safety Form Generator is free and needs no account.