Preparing Documentation for Google Play Review
Google Play Review differs from App Store in that most initial checks are automated. But this doesn't mean "easier" — it means "different pitfalls." Automation catches mismatches in manifest declarations, permission declarations, and data retention policies. Live reviewers join later when the algorithm has already flagged issues.
Documentation Structure for Play Console
Data Safety section — analog of Apple Privacy Nutrition Label but with more detailed breakdown. Requires specifying for each data type: is it collected, is it shared with third parties, can users delete it on request. Error in this section is one of the main rejection reasons in 2024–2025. Each connected SDK must be checked separately: Google Analytics, Firebase Crashlytics, Adjust, Unity Ads — all have their own Data Safety FAQs to account for.
Content Rating via IARC — questionnaire asking about violence, sexual content, gambling. Rating mismatch with actual content leads to app removal. For apps with UGC (user-generated content), rating is typically set to maximum.
Target Audience and Content — section for apps potentially targeting children. If targetSdkVersion + theme + screenshots indicate child audience, Google requires COPPA compliance and automatically applies restrictions to advertising SDKs.
App Access in Play Console — analog of App Review Information for Apple. Test credentials, reviewer instructions, and information about features available only with specific hardware are specified here.
Permission Declarations — A Separate Story
Starting with Android 13, using READ_MEDIA_IMAGES, READ_MEDIA_VIDEO, READ_MEDIA_AUDIO instead of deprecated READ_EXTERNAL_STORAGE is mandatory for new apps and updates. If the old READ_EXTERNAL_STORAGE remains in AndroidManifest.xml without android:maxSdkVersion="32" — Play Console sends a warning and in some cases blocks publication.
Permissions like MANAGE_EXTERNAL_STORAGE, REQUEST_INSTALL_PACKAGES, PACKAGE_USAGE_STATS, and Accessibility Service usage — all require separate justification in Declaration Form. Without the completed form, the app won't pass review.
Separately, READ_PHONE_STATE and Device ID access. Since 2022, Google is steadily tightening requirements for device identifier usage. If an SDK collects IMEI or Android ID without explicit business necessity — review will reject it.
What We Check During Preparation
Complete audit of AndroidManifest.xml against current policies. Verification of all used SDKs against Google Play Families Policy if the app works with child audience. Filling Data Safety section accounting for actual traffic (verifiable through Charles Proxy or mitmproxy). Preparing reviewer instructions with test data and non-standard functionality descriptions.
Preparation timeline: one to two business days.