Fix an invalid Data safety form rejection

You selected “no data collected,” but Google found data leaving the app. Check the libraries as well as the code you wrote. These can include software development kits (SDKs) that add features or connect the app to other services. Analytics, crash reporting, sign-in, advertising, and embedded web content can all affect the answer.

Google’s Data safety definitions include relevant SDK behavior. Permissions and collection are separate questions: an app can send data without asking for a camera or location permission.

Start with the rejection’s data type

Save the named data type, affected version, evidence, and exact notice. Ask your developer to inspect that build’s dependencies and settings, then trace the relevant requests with test data. An SDK’s default behavior may differ from the configuration your app ships.

We’d make a small inventory before touching the form. It keeps you from fixing one answer while overlooking the library responsible for it.

Field	Record for each data flow
Data	The actual fields sent, including identifiers
Source	App feature, embedded page, SDK name, and version
Recipient	Your server and any onward service provider
Purpose	What the recipient uses the data for
Timing	Launch, sign-in, user action, or background activity
User choice	Whether the flow is required or optional and what happens after refusal
Storage	Where it’s retained, for how long, and how deletion works
Evidence	Configuration, current SDK documentation, and observed test behavior

Use the inventory to map your data to Google’s categories. A service provider working on your behalf has different sharing treatment from an independent recipient; check the definitions before selecting the answer.

Choose the correction you actually need

If the app needs the data, correct the disclosure and confirm the privacy policy describes the same practice. If the collection is unnecessary, change the app or SDK configuration, produce a corrected build, and verify the unwanted transmission stopped.

Retest startup, sign-in, the affected feature, and consent refusal. Inspect relevant distributed versions and regions, not just a development build with analytics disabled. Keep personal data out of the screenshots or logs you attach to a support response.

There isn’t a universal set of correct answers for a named SDK. Its version, enabled features, and your use of the data affect the declaration.

Handle ephemeral processing separately

Ephemeral processing means using data only in memory, for no longer than needed to answer a specific request in real time. As checked on 22 September 2026, Google’s source still contains conflicting instructions about whether qualifying ephemeral processing belongs in the form response. See the explanation in our Data safety guide. Seek clarification for that specific case; retained logs aren’t automatically ephemeral just because the main request is short-lived.

Update Data safety in App content, save the corrected answers, and check Publishing overview for the required submission action. You’re ready to resubmit when the declaration, privacy policy, and tested build describe the same behavior.