If you publish an app on the App Store or Google Play, you have to tell each store what data your app collects and what it does with that data. Apple calls this App Privacy Details. Google calls its version the Data Safety Section. Both are built from your own answers, and both hold you responsible for code you added but did not write.
Where the labels came from
Apple adopted privacy nutrition labels for the App Store in 2020. App Privacy Details became required in App Store listings starting December 8, 2020. Google followed in 2022, when it required developers to add a Data Safety Section to Google Play.
What counts as collecting data
Apple defines data collection as transmitting data off the device so that you or your third-party partners can read it for longer than it takes to service the request. Google's Data safety form uses the same test and defines collecting as transmitting data from the app off a user's device. Data that is processed only on the device and never sent anywhere does not have to be disclosed on either form.
Google also separates collection from sharing. Collection covers you retrieving user data from the device through the app. Sharing covers data transferred from the device to a third party. You can therefore declare sharing without collecting, for example when a third-party library sends data directly to its own servers.
Third-party code is your responsibility
Google requires you to declare the data your app collects and shares, including data handled by third-party libraries or SDKs. Apple defines third-party partners as analytics tools, advertising networks, third-party SDKs and other external vendors whose code is added to your app. It holds you responsible for their practices as well as your own. Google points developers to its SDK Index for help with the same question.
How Apple's label is organized
On the App Store product page, your answers appear under three headings: Data Used to Track You, Data Linked to You, and Data Not Linked to You. Placing data in the last group comes with conditions. Apple requires protections before collection, such as stripping direct identifiers, and forbids re-linking the data to the user afterwards.
Apple's list of data purposes has six entries. It ends in a catch-all called Other Purposes.
Some data types are optional to disclose, but only if they meet all four of Apple's criteria. Apple's own example is an optional feedback form.
- The data is not used for tracking, or for advertising, marketing or other purposes.
- It is collected only in infrequent cases outside the app's primary functionality.
- Providing it is optional for the user.
- The user supplies it in the app's own interface with their name shown, and chooses each time to send it.
How Google's form is organized
Google's Data Safety Section has four levels. At the top are the high-level privacy practices: Data Collection, Data Sharing and Security Practices. Below those come Data Categories, then Data Types, then Purposes.
The Security Practices section includes tags for Encrypted in Transit, Data Deletion Option, and Review against Global Security Standards. There are 14 data categories, such as App Info and Performance and App Activity. Google's purpose list has seven entries and no catch-all.
Google has no test that matches Apple's optional-disclosure rule. Its carve-outs are on-device processing, end-to-end encrypted data, and ephemeral processing. You enter these on the form, but they are not shown to users.
| Point | Apple | |
|---|---|---|
| Required since | December 8, 2020 | 2022 |
| Number of purposes | Six, ending in Other Purposes | Seven, no catch-all |
| Optional disclosure | Allowed if all four criteria are met | No equivalent test |
| Carve-outs | Data processed only on the device | On-device, end-to-end encrypted and ephemeral processing |
Filling in Apple's form
You set up privacy details in App Store Connect from your own account. The path looks like this.
- Open My Apps and select your app.
- Go to General, then App Privacy, then choose Get Started.
- Answer whether the app collects data.
- Select the data types it collects.
- For each type, specify the purposes, whether it is linked to the user's identity, and whether it is used for tracking.
An analytics add-on shows how small the answer can be. TelemetryDeck's default analytics collect only Device ID, under Identifiers, and Product Interaction, under Usage Data. Both are used for Analytics, are not linked to identity and are not used for tracking.
Filling in Google's form
Google launched a service called Checks. Its Data Monitoring feature lets you verify compliance with data safety policies before you submit an app for review. It monitors SDKs, in-app permissions and external sites, and provides evidence such as permissions and network traffic.
Mistakes that show up on Google Play
A study of Google Play found that as of May 2023, only 46.8% of apps had a Data Safety Section. The number with one grew from 312K to 539K between June 2022 and May 2023. Over the study year, about 40% of apps (283K) updated their section at least once, and 4% (27K) updated it at least twice.
Underreporting was common. Only 36% of apps reported sharing at least one data type. Yet among a subset of 15K popular apps that reported no sharing, 42% used at least one third-party advertising or analytics library.
Overreporting appeared too. Over 3.5K apps listed six or more of the seven possible purposes for every data type they collect. The study found that Google's enforcement does not penalize overstating data collection, likely because of limits in static and dynamic code analysis checks.
Some answers contradicted each other. 40% of apps said they do not collect or share data but encrypt data in transit, and 59% of apps that request no network permissions said they encrypt data in transit. 11.5% reported collecting or sharing precise location without location permissions.
Before you submit
Start with what leaves the device, then list every SDK you added and what it sends. Answer each form on its own terms, since Apple and Google differ on purposes and exemptions. Accurate answers will not guarantee how a review goes. They do give your users a label that matches what your app actually does.