Home > Blogs > Google Play Store Privacy Requirements - The Rules

Google Play Store Privacy Requirements - The Rules

Google mandates certain privacy requirements that may depart from UK data protection laws at times, including very detailed rules on device permissions. Adherence to both the UK GDPR and Google privacy requirements is fundamental to ensure your app gets listed on the Play Store.

If you want to get your smartphone app listed on the Google Play Store in the UK, then you must follow Google’s various policies on privacy in addition to UK data protection laws. A failure to comply with the rules may lead to the rejection of your app and a removal of your developer privileges under the Google Play Console programme.

Google’s privacy requirements for getting smartphone apps approved on the Play Store are detailed and a lot more prescriptive than Apple’s privacy requirements (we have commented on the Apple guidelines here). 

This article will explain some of the key requirements to follow from the purview of Google’s privacy requirements, including any disclosure requirements, and in what ways it may depart or diverge from UK data protection laws.

Combining data

Google’s privacy rules contain duties against combining different datasets which may otherwise result in the overly invasive tracking of users. Therefore, linking device IMEIs and SIM serial numbers with location data and advertising IDs is generally impermissible. Where linking is necessary or unavoidable, developers should give ‘prominent disclosure’ of such activities. This is a divergence from UK law, as the UK GDPR generally allows the combining of datasets (known as ‘data matching’) as long as certain requirements are met. Furthermore, Google also requires that developers should ensure that the use of historical information (e.g. device IDs or advertising IDs) cannot be used or combined with other information to trace back to users when they reset their devices.

Device permissions and APIs

Google has rules on APIs which access sensitive user data and require device permissions that are very detailed with separate rules for each individual type of permission being sought. Most of the APIs listed under this policy require the developer to declare use of the same in Google Play Console and may be subject to an ‘access review’ by Google to determine if they are privacy compliant.

Generally, Google stipulates that APIs must only be used, and device permissions sought, for ‘core functionality’ affecting the app. Google defines this as the main purpose of the app, which may include a set of core features that must all be prominently documented in the app's description. Without the core feature(s), the app is 'broken' or rendered unusable. Google then goes on to label permissions into ‘dangerous’, ‘special’, and ‘signature’ permissions according to the level of invasiveness the permission requires of a user’s device and data.

Each type of device permission sought from different APIs are listed and contain varying rules and requirements. For example, location APIs require the ‘Android location button’ to be shown on the GUI where precise location tracking is required for one-time user-initiated actions. Meanwhile, in relation to health data, permissions should be granular and requested for each type of bodily measurement being used.

Google also states that it may make exceptions to its rules on permissions in rare cases for permissions where apps provide a highly compelling or critical feature and where there is no alternative method available to provide the feature. As such, the general rule is that, where the app can function via an alternative means, users should be given the option not to accept device permissions. 

Child users

Google’s privacy rules contain special requirements for child users. Google does not allow SDKs and APIs that are not approved for ‘child-directed services’ to be used in smartphone apps. However, apps that are not ‘child-directed’ and target both children and adults can use non-approved API and SDKs as long as they do not collect data from children or are behind an age identifier. There is also a ban on collecting and transmitting certain types of device data, such as location data, advertising IDs, and IMEIs. Google also recommends using its ‘companion device manager’ API for app connectivity via Bluetooth to third-party devices where the app is targeted toward children. In any event, these rules are supplementary and in addition to the requirements under the UK GDPR, including the ICO’s Children’s Code.

Data security

Google has a standalone policy on data security that has rules on ‘flag secure’ codes, the use of virtual Android operating systems, app updates and more. These requirements generally depart from the UK GDPR’s ‘technical and organisational’ measures which data controllers are required to implement by law, since Google’s requirements on data security are unique to their digital infrastructure and operations.

Privacy disclosures

As part of the process of being approved to be listed on the Google Play Store, Google requires the disclosure of certain mandatory and optional information in relation to privacy and data protection. The information disclosed here will be accessible by anyone via the app’s Play Store listing. Generally, user data transmitted from a user’s device elsewhere, including via SDKs, APIs, and web viewers opened in app (to the extent users are viewing the app owner’s content controlled by code by their app and not simply browsing the web), are mandatory to disclose. Moreover, transferring user data from your app to another app directly on the user’s device, even if no data is transferred off of the device, also requires mandatory disclosure. Certain processing activities are optional to disclose. These include ‘ephemeral’ or ‘transient’ processing, as well as encrypted or anonymised data.

Google privacy requirements and UK laws

Though, generally, Google’s requirements on privacy mirror the laws contained within the UK GDPR, there is some divergence at points. This means that app owners and developers should undertake compliance activities that document and evidence that privacy laws have been and will be complied with both in the Google sense and the UK GDPR sense.

About the author

Nabiel Junjua (CEO & Solicitor) is a lawyer who specialises in commercial law and legal compliance for technology and digital businesses, having previously advised businesses on digital regulations pertaining to their digital content and software applications. You can learn more about Nabiel here and contact him for support on your legal matters.