How to Fix “Your App Is Not Compliant with Google Play Policies” | Reviewing Data Safety and AdMob Settings

When publishing an app on Google Play, you may receive a message from Google Play stating:
“Action Required: Your app is not compliant with Google Play policies.”

After receiving this notification for one of my published apps,
I reviewed the declarations in the “Data safety” section of Google Play Console.

Even if the app itself does not collect personal information such as names or email addresses,
an advertising SDK may collect and share certain types of data when
Google AdMob (Google Mobile Ads SDK) is used.

This article explains the potential severity of receiving a Google Play policy notification
and summarizes the Data safety settings I reviewed for an app using AdMob.

Overview

Receiving a Google Play Policy Notification

I received a notification from Google Play stating:
“Action Required: Your app is not compliant with Google Play policies.”

Apps published on Google Play are required to comply with the
Google Play Developer Program Policies and other applicable requirements.
Developers are also required to accurately declare how their apps collect and share user data
in the Data safety section.

I therefore reviewed the settings in Google Play Console,
particularly the declarations in the Data safety section.

How Serious Is This Notification?

Receiving a message stating that your app is not compliant with Google Play policies
does not necessarily mean that your Google Play developer account will be immediately terminated.

Google Play has several types of enforcement actions for policy issues,
including rejection, warnings, removal, and suspension.
Rather than determining the severity based only on the wording of the email,
it is important to check the “Policy status” section in Google Play Console
to determine what action has actually been applied to your app.

Status	Typical Impact	Impact on Developer Account
Rejection	A new app or app update is not published	Generally does not affect the standing of the developer account
Warning	The app may be removed if the issue is not corrected by the specified deadline	A warning itself generally does not affect the standing of the developer account
Removal	The app is unavailable on Google Play until a compliant update is approved	A single removal does not necessarily affect the account immediately, but repeated removals may lead to suspension
Suspension	The app is suspended from Google Play	Counts as a strike against the standing of the developer account
Account Termination	Apps associated with the account are removed and new apps can no longer be published	The developer account itself is terminated

It is particularly important not to ignore warnings or removals
or repeatedly violate the same or similar policies.

According to Google’s policy enforcement information,
app suspensions may occur for serious or multiple violations,
as well as repeated app rejections or removals.
Multiple suspensions or serious policy violations may also result
in termination of the Google Play developer account.

Third-Party SDKs Must Be Considered Even If You Do Not Collect Data Yourself

One important point about the Data safety section is that
not storing user data yourself does not necessarily mean that your app collects no data.

If your app includes a third-party SDK such as AdMob,
you must also consider the data collected and shared by that SDK.

Google’s official documentation for the Google Mobile Ads SDK
states that the SDK automatically collects and shares data including
IP addresses, user product interactions, diagnostic information,
and device or account identifiers.

Data Collection and Security

Collection or Sharing of User Data

Because this app uses AdMob,
I selected “Yes” for the question asking whether the app
collects or shares any of the required types of user data.

Encryption in Transit

Google Play Console also asks whether all user data collected by the app
is encrypted while being transferred.

Google’s documentation for the Google Mobile Ads SDK states that
all user data collected by the SDK is encrypted in transit
using Transport Layer Security (TLS).

For this app configuration,
I therefore selected “Yes” for the question asking whether
all collected user data is encrypted in transit.

Account Creation

This app does not provide user account functionality.

For the account creation question,
I therefore selected the option indicating that
the app does not allow users to create an account.

I also selected “No” for the question asking whether users
can sign in to the app using an account created outside the app.

Data Types

Because the app uses AdMob,
I reviewed the following data types in the Google Play Console Data safety section.

Location

• Approximate location: Selected
• Precise location: Not selected

The app itself does not use GPS to obtain the user’s location.
However, the Google Mobile Ads SDK collects IP addresses,
which may be used to estimate the general location of a device.

Personal Information

• Name: Not selected
• Email address: Not selected
• User IDs: Not selected
• Address: Not selected
• Phone number: Not selected
• Race and ethnicity: Not selected
• Political or religious beliefs: Not selected
• Sexual orientation: Not selected
• Other information: Not selected

This app does not provide user registration or login functionality
and does not directly collect these types of personal information,
so these options were not selected.

App Activity

• App interactions: Selected
• In-app search history: Not selected
• Installed apps: Not selected
• Other user-generated content: Not selected
• Other actions: Not selected

The Google Mobile Ads SDK may collect information about user interactions,
including app launches, taps, and video views.

App Information and Performance

• Crash logs: Not selected
• Diagnostics: Selected
• Other app performance data: Not selected

For this app configuration,
I selected “Diagnostics” to account for diagnostic information
collected by AdMob.

Device or Other IDs

• Device or other IDs: Selected

The Google Mobile Ads SDK may collect identifiers such as
the Android advertising ID and App Set ID.

Summary of the Data Types Selected

Category	Data Type
Location	Approximate location
App activity	App interactions
App information and performance	Diagnostics
Device or other IDs	Device or other IDs

Data Usage and Handling

Collection and Sharing

For the four data types reviewed above,
I selected both “Collected” and “Shared”
based on the data handling practices of AdMob.

• Collected: Selected
• Shared: Selected

Is the Data Processed Ephemerally?

Google Play Console also asks whether collected data
is processed ephemerally.

In this context, ephemeral processing means that the data is stored only in memory,
retained only for as long as necessary to fulfill a specific request in real time,
and not used for any other purpose.

For this declaration,
I selected the option indicating that
the collected data is not processed ephemerally.

Required or Optional Data Collection

Google Play Console also asks whether users can choose
whether their data is collected.

Because this app does not provide its own in-app option
allowing users to completely disable the relevant AdMob data collection,
I selected the option indicating that data collection is required.

Purposes of Data Collection

For the four data types described above,
I selected the following three purposes for data collection:

• Analytics
• Advertising or marketing
• Fraud prevention, security, and compliance

I did not select
“App functionality,” “Developer communications,”
“Personalization,” or “Account management.”

Purposes of Data Sharing

I selected the same three purposes for data sharing:

• Analytics
• Advertising or marketing
• Fraud prevention, security, and compliance

Google’s official documentation for the Google Mobile Ads SDK
states that the relevant data is automatically collected and shared
for advertising, analytics, and fraud prevention purposes.

Preview

After completing all settings,
review the preview in Google Play Console
to check how the Data safety information will appear to users.

For this app, I declared the following four main data types
in relation to AdMob:

• Approximate location
• App interactions
• Diagnostics
• Device or other IDs

In the preview,
check that the declared data collection and sharing practices
are displayed as intended.

It is particularly important to make sure that the declaration reflects
not only information collected directly by the app,
but also information collected by third-party SDKs such as AdMob.

Check the SDKs Used by Your App

When reviewing the Data safety section,
it is a good idea to check all SDKs included in your app,
not only AdMob.

For example, if you use any of the following services,
you should check the data collection practices of each service.

• Google AdMob
• Firebase Analytics
• Firebase Crashlytics
• Google Analytics
• Login and authentication services
• Cloud storage services
• Third-party advertising SDKs
• Other analytics SDKs

Even two apps that both use AdMob may require different
Data safety declarations depending on the additional SDKs,
features, versions, and configurations they use.

Check Google’s Official Documentation

Google provides official documentation describing
the data collected by the Google Mobile Ads SDK.

Google Play also provides detailed documentation about
the Data safety section and policy enforcement.

• 
  Google Mobile Ads SDK – Google Play Data Disclosure
  
• 
  Provide Information for Google Play’s Data Safety Section
  
• 
  Check Your App’s Policy Status
  
• 
  My App Has Been Removed from Google Play
  

SDK behavior and Google Play policies may change over time.
Even if you completed the Data safety section previously,
it is important to compare your current app configuration
with the latest official documentation when you receive a policy notification.

Summary

After receiving a notification stating
“Your app is not compliant with Google Play policies,”
I reviewed the Data safety declarations for the app.

Because this app uses AdMob,
I reviewed the declarations for approximate location,
app interactions, diagnostic information,
and device or other IDs,
as well as how these data types are collected, shared, and used.

Receiving a policy notification does not necessarily mean
that your developer account will be immediately terminated.
However, ignoring policy issues or repeatedly violating Google Play policies
may result in app removal or suspension,
and serious or repeated violations may ultimately lead
to termination of the developer account.

When you receive a policy notification,
first check the “Policy status” section in Google Play Console
and correct the identified issue.

When completing the Google Play Data safety section,
you should also consider not only the behavior of the app itself,
but also the data handled by SDKs such as AdMob.