Privacy Policy Requirements for Mobile Apps: What You Must Disclose

A privacy policy is not a formality. For a mobile app, it is a store-acceptance gate. Apple and Google both reject apps that ship without a legally adequate privacy policy, and both check the policy against the data your app actually collects. If your AI-built app includes analytics, crash reporting, or advertising, you almost certainly need one before launch.

This guide covers what a mobile app privacy policy must disclose, which legal frameworks apply, and what the stores inspect before they let your app through.

When your app needs a privacy policy

A mobile app needs a privacy policy when it does either of the following (Usercentrics):

Directly collects and uses personal data.
Uses data from third-party services, such as Google Analytics.

In practice, this covers almost every shipped app. If you include Firebase Analytics, Crashlytics, AdMob, RevenueCat, or any authentication provider, your app is processing personal data and needs a policy. An AI-built app that calls an LLM API and ties usage to a user account is collecting personal data.

What the stores require

Google Play requires developers to add an app privacy policy and to comply with the data-protection laws relevant to the locations of their users. Specifically, Google requires (Usercentrics):

A legally adequate privacy notice and protection for users.
Data-minimization principles — collect only what the app needs.
User consent before collecting or processing personal information.
A prominent disclosure when information is collected in the background without it being obvious that collection is occurring.
The policy must be placed in the app, in the app description, and on a publicly accessible website, in a way that is easy to access and understand.
The policy must be added in the designated field in the Google Play Console, and kept updated after publishing.

Apple applies an equivalent standard through its App Privacy questions in App Store Connect. You must declare the data your app collects and link to a hosted privacy policy URL before submission. An inaccurate declaration is grounds for rejection or removal.

What the policy must disclose

A clear, comprehensive privacy policy should include (COS):

1. App and developer identity

The app name, the developer or company name, who the policy applies to, and what it covers.

2. Information collected

Automatically collected data typically includes device model, operating-system version, advertising identifiers (IDFA on iOS, Advertising ID on Android), usage data such as app opens and session duration, crash reports, and performance data. You must also disclose data collected by third-party services, such as Google AdMob for ads, Firebase Analytics for usage analytics, and Firebase Crashlytics for crash reporting, and link to each service's privacy policy (COS).

3. How information is used

State the purpose for each data type: to display ads, to analyze and improve the app, to identify and fix crashes, to prevent fraud. A data point collected without a stated purpose is a compliance gap.

4. Children's privacy

If the app might be used by children, include a dedicated children's section covering whether the app is suitable for all ages, compliance with COPPA, whether personal information is knowingly collected from children under 13, and contact information for parents or guardians (COS).

Which laws apply

Three frameworks cover most apps:

GDPR (EU): governs processing of personal data of EU residents. Requires a lawful basis for processing, user rights to access and deletion, and consent for non-essential collection. Applies to any app available in the EU, regardless of where the developer is based (ENISA).
CCPA / CPRA (California): gives California residents the right to know what personal information is collected, to delete it, and to opt out of its sale.
COPPA (US): a federal law that applies to apps directed at children under 13, or that have actual knowledge of collecting personal information from children under 13. Requires verifiable parental consent and limits data collection (COS).

Common rejection reasons

No privacy policy URL, or a URL that returns a 404.
A policy that does not match the data the app actually collects (the stores cross-check your declaration against the SDKs in your binary).
No prominent in-app disclosure for background data collection.
No children's section when the app could attract underage users.
A copied, generic policy that does not name the app, the developer, or the third-party services used.

How to get it right

List every third-party SDK in your app, identify the data each one collects, state the purpose for each data type, host the policy on a public URL that you control, and keep it updated when you add or remove SDKs. If your AI-built app calls an LLM provider, disclose that user inputs and account data may be processed by that provider, and link to the provider's policy.

A privacy policy is not boilerplate. It is a statement of exactly what your app does with user data, and the stores will verify it.

Check your app before the store does

Run a free Launch Score to surface privacy, security, and store-readiness gaps before you submit. No signup required.

Run the free Launch Score

Sources

Frequently asked questions

Does my app need a privacy policy for the App Store?

Yes. Both Apple App Store and Google Play require a privacy policy for all apps that collect any user data, including analytics, crash reporting, and advertising identifiers. Apps without a privacy policy will be rejected during review.

What should my app privacy policy include?

Your privacy policy must list what data you collect, how it is used, whether it is shared with third parties, user rights including account deletion, data retention practices, and contact information for privacy inquiries. AI apps should also disclose if user data is sent to AI providers.

Can I use a free privacy policy generator for my app?

Free generators provide a starting point but may not cover app-specific requirements like SDK disclosures, advertising identifiers, or AI data processing. Review your generated policy against Apple and Google requirements before submitting.