Apps whose Play Data Safety label does not match the app

What this finding means

Every app on Google Play must publish a Data Safety declaration describing what data it collects, what it shares with third parties, and why. The declaration is written by the developer; nothing in the store verifies it against the binary.

This category compares that declaration against what the APK itself shows. It covers two distinct contradictions. The first is an app that declares no data shared with third parties while shipping advertising or analytics SDKs whose purpose is to send data to a third party. The second is a label that omits a data category the app demonstrably touches, such as location or calendar access backed by a declared permission.

We have recorded this in 729 apps whose declarations we were able to read.

Why it matters

A Data Safety declaration is a policy commitment, not marketing copy. Google can reject an update or remove an app for a declaration that does not match its behaviour, and the form is one of the few places regulators and privacy researchers can point to as a written statement of intent.

It also matters in the other direction. Most mismatches we see are not deception; they are an SDK added after the form was filled in, or a label completed by someone who did not know what the ad mediation layer transmits. That is cheap to correct and expensive to leave.

How to fix it

• List every third-party SDK in the build and check what each transmits. Ad mediation and analytics SDKs almost always share data with a third party, which is a declarable act.
• Update the Data Safety form to declare the sharing and the categories involved, including those an SDK performs on the app's behalf.
• If the sharing is not wanted, remove or reconfigure the SDK; several analytics SDKs can be initialised without advertising identifiers.
• Re-check the form on every release where a dependency changed, not only when the app's own code changes.

How we detect it, and what it cannot tell you

The declaration is read from the app's public Play listing and compared against SDKs and permissions observed in the APK. A declaration we could not parse is never treated as an empty one — an earlier version of this check did that and reported apps that had in fact declared their data correctly, so the parser now records which sections it actually read and refuses to compare unless both were readable.

The limits are real. The presence of an SDK shows a capability, not a transmission: an SDK compiled in but never initialised sends nothing. A declaration can also be newer than the release analysed. Treat this as a prompt to check the form against the build, not as proof of a policy breach.