If your submission is frozen because Play Console keeps flagging the Data Safety section, you are not alone. The google play data safety form is one of the most common blockers publishers hit, especially when they built their Android app by wrapping an existing website rather than writing native code by hand. The questions assume you know exactly what your app collects, shares, and transmits – and when you are not the person who wrote every SDK, that can feel like guesswork.
This guide walks through the form field by field, and maps each answer back to the features you actually enabled in AppLikeWeb – Firebase push notifications, analytics, advertising, and file or camera permissions. AppLikeWeb converts your existing responsive website into native apps and lets you toggle these capabilities on or off, so your Data Safety answers should reflect exactly what you switched on. Nothing more, nothing less.
Where the Google Play Data Safety Form Lives in Play Console
Before you fill anything in, find the form. In Play Console, open your app and go to Policy and programs → App content → Data safety. Google splits the declaration into a few stages, and you must complete all of them before the “Submit” button unlocks:
- An overview page explaining the policy.
- Data collection and security questions (encryption, deletion, and whether you collect any data at all).
- Data types – a long checklist of categories such as location, personal info, and app activity.
- For each checked type, a detail page asking how it is used, whether it is shared, and whether collection is optional.
- A final review and store preview.
The golden rule Google enforces: your declaration must match your app’s real behavior, including anything your website and its third-party SDKs do. Since AppLikeWeb wraps your live site, remember that data your website already collects in a browser is still collected inside the app. Declare it.
Step 1: The Data Collection and Security Questions
The first real questions set the tone. Answer them honestly against your actual build:
- “Does your app collect or share any of the required user data types?” If you enabled Firebase push, analytics, ads, or your website captures any user information (logins, forms, carts), the answer is almost always Yes. A purely static brochure site with no forms, no analytics, and no ads may be able to say No – but check carefully first.
- “Is all of the user data collected by your app encrypted in transit?” If your website is served over HTTPS (it should be), answer Yes. AppLikeWeb loads your site over its secure connection, so traffic between the app and your server is encrypted in transit.
- “Do you provide a way for users to request that their data is deleted?” Answer based on your website’s actual policy. If your site offers account deletion or a privacy contact for deletion requests, select Yes and provide the deletion URL. If not, you may need to add one – Google increasingly expects a deletion path.
Step 2: Mapping AppLikeWeb Features to Data Types
This is where most publishers get stuck. The data-types checklist is long, but you only need to check the categories your app truly touches. Here is how the features you toggled in AppLikeWeb line up with Google’s categories.
- Firebase push notifications → Under Device or other IDs, check the identifier used to deliver notifications. Firebase Cloud Messaging relies on a registration token, so if push is enabled, declare this. Purpose is typically App functionality.
- Analytics / usage tracking → Under App activity, check items such as App interactions and, where relevant, Other user-generated content or Search history. Under App info and performance, check Crash logs and Diagnostics if your analytics captures them. Purpose: Analytics.
- Advertising (ad networks) → If you enabled monetization via ads, most ad SDKs use Device or other IDs (advertising ID). Purpose: Advertising or marketing. Many ad networks also count as data sharing with a third party – see Step 4.
- File downloads and storage permission → Handling files inside the app usually does not, by itself, mean you collect user files off the device. If files stay on the device and are not transmitted to you, you generally do not declare them. Only check Files and docs if your app uploads or sends those files to a server.
- Camera permission → Same logic. Requesting the camera permission is a permission, not automatically a data collection. Check Photos and videos only if captured media is transmitted off the device (for example, uploaded through a form on your site).
- Website account and forms → If users log in or submit forms, check the matching items under Personal info (name, email address) and Financial info if you process payments through the site.
The distinction that trips people up: a permission is not the same as data collection. Google’s form asks about data you collect (transmit off the device) or share (send to a third party). A camera or storage permission that only reads or writes locally, without sending anything to a server, does not need a data-type declaration – though you should still be prepared to explain it.
Step 3: Filling the Per-Type Detail Pages
For every data type you checked, Google opens a detail page with a handful of questions. Answer each consistently:
- Is this data collected, shared, or both? Collected means it leaves the device (analytics, push tokens). Shared means a third party receives it (ad networks are the classic example).
- Is this data processed ephemerally? Choose this only if the data is used in memory and never stored. Most analytics and push data is not ephemeral, so leave it unchecked unless you are certain.
- Is collection required or optional? If users can use the app without granting it (for example, they can decline push notifications), mark it optional. Core analytics that always runs is usually required.
- Purpose: pick every purpose that genuinely applies – App functionality, Analytics, Advertising or marketing, and so on. Do not select purposes you do not actually use.
Step 4: Handling Data Sharing and the Privacy Policy
Sharing is the field that quietly rejects submissions. If you turned on ads, assume the ad network receives the advertising ID and mark those types as shared. If you use a third-party analytics provider that Google treats as a separate company, that can count as sharing too. When data stays with Google’s own service processors (like Firebase acting on your behalf), Google generally treats it as collection rather than sharing – but review each SDK’s documentation.
Finally, every app that collects data needs a privacy policy URL that lives on your website and actually describes what you declared. Because AppLikeWeb wraps your existing site, the simplest approach is to publish a privacy policy page on that same site and link it in both the Data Safety form and your store listing. Make sure the policy mentions push notifications, analytics, and advertising if you enabled them – mismatches between the policy and the form are a common reason for rejection.
Step 5: Review, Save, and Submit
Before you submit, use Google’s store preview to see the exact “Data safety” card users will read on your Play listing. Sanity-check it against reality one last time:
- Every feature you enabled in AppLikeWeb (push, analytics, ads) is reflected in a matching data type.
- Nothing is declared that your app does not actually do – over-declaring can be as problematic as under-declaring.
- Your encryption-in-transit and deletion answers match your website’s real setup.
- Your privacy policy URL loads and covers the declared data.
Save the section, then submit. If Google later changes what your app collects – say you switch ads on or add a new form to your site – come back and update the form. The Data Safety declaration is a living document, and keeping it accurate protects your listing from future enforcement.
Clearing the Blocker for Good
The google play data safety form feels intimidating only because it asks you to know your app inside out. Once you map it back to the specific features you switched on – Firebase push, analytics, ads, and permissions – each answer becomes obvious. Declare what you collect, distinguish permissions from collection, mark shared data honestly, and point to a privacy policy that agrees with your answers. Do that, and the Submit button unlocks.
Ready to turn your website into an Android app and knock out the store paperwork with confidence? Start converting your website with AppLikeWeb and configure exactly the features your Data Safety form will describe.