A Data safety mismatch usually means Google found behavior that is not reflected in your Play Console answers or privacy policy. The form covers the app that users receive, including third-party libraries. Fix the mismatch by tracing data from the device to its destination, then make the binary, form, and policy describe the same reality.

Start with the data type Google named

Copy the issue text into the release ticket. Note the data type, whether Google describes it as collected or shared, and the affected artifact. Google's Data safety guidance defines collection as data transmitted off the device, including transmission performed by libraries and SDKs.

Build a one-page data map

  1. Source: what event or user action creates the data?
  2. Collector: your code, an embedded SDK, or the operating system?
  3. Destination: your server, a processor, or an independent third party?
  4. Purpose: core functionality, analytics, advertising, fraud prevention, support, or another declared use?
  5. Handling: optional or required, encrypted in transit, and deletable on request?
The most common blind spot is an SDK

Analytics, crash reporting, attribution, messaging, payments, and customer-support SDKs can send identifiers or diagnostics before your own API is called.

Audit the release artifact

Use the dependency list from the exact Android App Bundle you submitted. Review each SDK's current data disclosure documentation and compare it with the configuration enabled in production. Do not copy a vendor's entire template: optional modules and consent settings can change what your app actually sends.

Reconcile the three surfaces

  • The app and every SDK collect only the data you expect.
  • The Data safety form covers every distributed production variant.
  • Collected versus shared matches Google's definitions.
  • Purposes, optionality, encryption, and deletion answers are accurate.
  • The privacy policy names the same practices in plain language.

Change the form, the app, or both

If the behavior is intentional and compliant, correct the Play Console declaration and privacy policy. If the collection is unnecessary, disable it in the SDK or remove the dependency, then ship a new bundle. When both were wrong, update both before requesting review.

Resubmission note

Issue reviewed:
      [data type and collection/sharing finding]

      Root cause:
      [app code or SDK and configuration]

      What changed:
      [form, policy, SDK setting, or new bundle]

      Verification:
      [artifact version and test performed]

Keep the map with the release. The next time a dependency changes, you can review the delta instead of rebuilding the disclosure from memory.

Was this article helpful?