Google Play asks for a privacy policy URL in Play Console, and then asks about your data practices a second time in the Data safety form. The two are checked against each other, and against what your app actually does. That is the part that trips people up — not finding somewhere to paste a link, but keeping three descriptions of the same thing consistent.
Where it goes
The URL lives under App content in Play Console, in the Privacy policy section. The Data safety form sits on the same page and covers what you collect, what you share, and how a user deletes their data.
Unlike a store listing field, this is account-and-app level configuration: you can fix the URL without shipping a new release, which is worth knowing when the page goes down a year from now.
What makes Play reject the URL
Google is stricter than Apple about the page itself, not just whether it loads:
- It must be non-editable. A public Google Doc that anyone can edit does not qualify. This surprises people, because the same doc satisfies a naive "does the link work" check.
- It must be publicly accessible without a login, and not geo-blocked.
- It must identify the developer — the entity name on your Play listing should appear in the policy.
- It must name the app or clearly cover it. A company-wide policy that never mentions the product is weak.
- It must not be a redirect chain ending somewhere unrelated.
The consistency problem
The single most common source of trouble is not the URL, it is disagreement between three places:
- What the Data safety form declares.
- What the privacy policy says.
- What the app and its SDKs actually do.
Ad SDKs, analytics and crash reporters all collect things you did not write yourself. If your policy is silent about an advertising identifier your ad SDK collects, the form and the policy disagree, and that is enforceable after publication rather than only at review time. Read your dependency list before you write the policy, not after.
Hosting the page
The requirement is a stable, public, non-editable HTML page. That rules out the shared-document shortcuts and rules in almost anything else.
If you have no site to put it on, you can host a static page free on BetaDrop — drop an index.html or a zip and paste the resulting HTTPS URL into Play Console. The same page satisfies Apple's requirement, so if you ship on both stores you write it once.
While you are in App content
Play's Data safety form also asks how users delete their account and data. If your app has accounts at all, you will need a web URL where deletion can be requested — reachable without the app installed. It is a separate field from the privacy policy, and it is a common reason an otherwise complete submission stalls.
If you are testing the build with real users before any of this goes live, you do not need a Play track to do it — you can share the APK directly and collect feedback while the store paperwork is still in progress.
Frequently Asked Questions
Where does the privacy policy URL go in Play Console?
Under App content, in the Privacy policy section. The same URL is referenced by the Data safety form, and both have to be completed before you can publish.
Why is Google Play saying my privacy policy URL is invalid?
The usual causes are a URL that redirects somewhere unexpected, a page behind a login, a page that is editable by anyone such as an open Google Doc, or a policy that never names the developer or the app.
Does my Android app need a privacy policy if it collects no data?
You still need to complete the Data safety form, and a privacy policy is required for apps that access sensitive permissions or user data. Providing one regardless is the simpler path, and it is required for the App Store anyway.
Can I use the same privacy policy for Google Play and the App Store?
Yes, provided it accurately describes both builds. One hosted page can serve both listings, which is what most small teams do.
Does the privacy policy have to match the Data safety form?
Yes. Google compares your declarations against your policy and your app behaviour. A mismatch between what the form declares and what the policy says is a common cause of rejection and of enforcement after publishing.
