Play Rejection Wiki

Invalid Data safety form

Invalid Data safety · Data safety section · Data safety form · privacy policy required

Sources:O5 Data safety section·O6 User Data·O3 Prepare your app for review·A1 Declare your app's data use· last-checked: 2026-11-09

What you typically see

  • Policy / review notice that the Data safety declaration is invalid, incomplete, or inconsistent with app behavior.
  • Blocked update or rejection until the App content → Data safety form is corrected and re-reviewed.
  • Sometimes paired with privacy-policy URL problems on the same App content page.

What public docs say

From O5:

  • All developers with an app published on Google Play must complete the Data safety form (including closed, open, or production testing tracks). Apps only on an internal testing track are exempt.
  • Declarations must cover data collected or shared through third-party libraries or SDKs, not only first-party code.
  • A privacy policy is required to complete the form and show Data safety information to users. Even apps that collect no user data must complete the form and provide a privacy-policy link (which may state that no data is collected or shared).
  • You alone are responsible for complete and accurate declarations. Google may take enforcement action when it becomes aware of a discrepancy between app behavior and the declaration.
  • Google’s review is not designed to verify accuracy/completeness on your behalf; only you have all the information needed to fill the form.
  • Misrepresented data / policy violations can require a fix; non-compliant apps are subject to enforcement (for example blocked updates or removal), per O5 FAQ.

From O6 (User Data policy): Data safety disclosures must accurately reflect how the app handles user data; the privacy policy and in-app practices must align with declared collection/sharing.

From O3 (privacy policy hosting — common companion fix):

  • Active, publicly accessible URL (http:// or https://) with a valid SSL certificate
  • Accessible worldwide — no geographical restrictions, geofencing, or login
  • Standard webpage — not a PDF or downloadable file
  • Specific to your app; discloses collection, use, and sharing

From A1: Guidance for mapping APIs/permissions to Data safety categories — supporting only; the developer remains responsible for the Console declaration.

Community keyword reports (not official): “Issue found: Invalid Data safety form” style threads — see SOURCES.md F1. Keyword discovery only.

What to fix

  1. Open Play Console → App content → Data safety and set the form status so you can edit.
  2. Inventory every data type your app and its SDKs/libraries collect or share off-device (O5). Check SDK vendor Data safety guidance / Play SDK Index links where available.
  3. For each data type, answer collection vs sharing, ephemeral processing (if applicable), required vs optional, purposes, and security practices exactly as the form defines them (O5).
  4. Ensure a compliant privacy policy URL is linked (O3) and that the policy text matches the form and O6 expectations.
  5. Preview the store-listing Data safety card in Console; fix mismatches before submit.
  6. Save/submit the form, then send the app update (or publishing changes) for review. Do not resubmit until declarations match live behavior.

Before you resubmit

Related