How App Privacy Labels Work and Where They Fall Short for Users
Apple and Google both require developers to describe their data practices on store listings. Those labels are self-reported, so readers should know what they reveal, what they miss and how rules are tightening.
An editorial article written by TechAmerica.ai. Not sponsored, and not paid for by any company.
Open almost any listing on Apple’s App Store or Google Play, and you will find a summary of what data the app collects and why. These app privacy labels are meant to help people compare apps before installing them, much like a nutrition panel on food. They are useful, but developers write them, and their design leaves gaps for anyone deciding which app to trust with location, contacts, health details, or a child’s information.
This explainer covers what each store asks for, who checks the answers, how third-party code complicates the picture, and which federal rules sit behind the labels. It also outlines questions readers and product teams can ask when a label alone isn’t enough.
What the Two Major Stores Ask Developers to Disclose
Apple calls its version “App privacy details.” Developers fill in a questionnaire in App Store Connect, and the answers appear on the product page. Apple says developers must describe their app’s privacy practices, “including the practices of third-party partners whose code you integrate into your app.” Apple requires this disclosure for new apps and updates.
Apple’s definition of collection is broad. Apple considers data collected when it is transmitted off the device in a way that lets the developer or a partner access it longer than needed to answer a request in real time. Apple also reminds developers to declare data gathered for reasons other than analytics or advertising. Answers are sorted by whether data is used for tracking, whether it is linked to the user’s identity, and its purpose.
Google’s equivalent is the Data safety section, which developers complete in Play Console. It asks whether an app collects or shares specific data types, how it uses that data, whether it encrypts it in transit, and whether users can request deletion. Developers also mark each data type as required or optional and list the purposes for collecting and sharing it.
Google requires every developer with an app published on Google Play to complete the form, including apps that collect no user data at all. Apps that run only on internal testing tracks are exempt. Google defines collection as transmitting data off a user’s device, and sharing as transferring collected data to a third party.
Where the definitions differ
The two schemes aren’t identical so that the same app can look different on each store. Google, for example, does not treat processing that happens only on the device, end-to-end encrypted data the developer cannot read, or brief in-memory processing as collection. It also excludes transfers to service providers, legal requests and fully anonymized data from its definition of sharing. Apple uses its own exceptions, including a short list of cases where a data type is optional to disclose, and each case requires a developer to meet every listed criterion.
Self-Reported by Design: Who Checks the Answers
The stores do not independently audit app privacy labels before publication. Google’s help page says plainly that its review process “is not designed to verify the accuracy and completeness of your data safety declarations.” It says that developers alone are “responsible for making complete and accurate declarations.” Google adds that it may take enforcement action if an app’s behavior doesn’t match what the developer declared.
Apple puts the burden on developers in similar terms. Its guidance says developers are “responsible for keeping your responses accurate and up to date.” It also notes that developers can change their answers at any time without shipping an app update. That flexibility helps when practices change, but it also means a label can shift between versions without users noticing.
For readers, this means a label describes what a developer says it does. It is a starting point for judgment, not a certificate. A label with little data isn’t proof of good practice, and a long label isn’t automatically a warning sign. A detailed, specific disclosure may come from a developer that took the questionnaire seriously.
Third-Party SDKs and Shared Responsibility
Most apps are assembled partly from code written by other companies. Software development kits, or SDKs, handle analytics, crash reports, advertising, login, payments and maps. Each one may send data to its own servers, and app developers do not always know exactly what that code transmits.
Both stores hold app developers accountable for that code. Google states that the Data Safety Declarations cover data handled by third-party libraries and SDKs. Apple’s App Tracking Transparency guidance is even more blunt: “Developers are responsible for all code included in their apps.” Apple gives a concrete example of tracking a developer must declare: embedding an SDK that combines data from many developers’ apps to target or measure advertising, “even if you don’t use the SDK for these purposes.”
Privacy manifests
Apple has tried to make SDK behavior easier to see. Developers and SDK makers can ship a privacy manifest file that declares the data the code collects, and Xcode combines those manifests into a single privacy report for the app. According to a summary by the mobile build platform Bitrise, App Store Connect stopped accepting new apps on May 1, 2024, if they didn’t describe their use of certain “required reason” APIs. Because developers could misuse these system interfaces to identify a device, they must state an approved reason for calling them.
The same requirements apply to a set of commonly used third-party SDKs on a list Apple maintains. Apple’s rules also state plainly that fingerprinting, deriving data from a device to identify it uniquely, is not allowed whether or not a user grants tracking permission. TechAmerica.ai’s apps news coverage follows changes to these store policies.
Tracking Prompts and What They Actually Change
Labels describe practices. Permission prompts are where users make choices. On iPhone, the App Tracking Transparency framework requires apps on iOS 14.5, iPadOS 14.5 and tvOS 14.5 or later to obtain the user’s permission before tracking them or reading the device’s advertising identifier.
Apple defines tracking as linking user or device data from an app with data from other companies’ apps, websites or offline properties for targeted advertising or ad measurement, or sharing that data with data brokers. If a user does not grant permission, the advertising identifier returns all zeros. Apple also says developers can’t bypass a refusal by switching to other identifiers, such as hashed email addresses or phone numbers.
A refusal limits one category of data use. It does not stop an app from collecting data for its own functions, analytics within the same developer’s apps, or fraud prevention. That distinction is easy to miss. A user who taps “Ask App Not to Track” limits cross-company tracking, but the app’s privacy label still describes everything else it may collect.
Rules on how apps ask
Apple’s guidelines bar apps from making features conditional on tracking consent or offering rewards for it. Developers may explain why they want permission, but Apple’s guidance says apps must not “manipulate, trick, or force people to consent to unnecessary data access.” Apple’s developer documentation also describes a separate prompt design option for developers in the European Union, showing that Apple is still adjusting the consent flow by region.
Children’s and Health Data: Where Federal Rules Apply
Store labels are a private policy tool. In the United States, a handful of federal rules carry legal force for specific kinds of data, and they apply whether or not an app’s label is accurate. Two are especially relevant to apps.
The amended COPPA Rule
The Children’s Online Privacy Protection Act Rule, enforced by the Federal Trade Commission, governs online services directed at children under 13 or that knowingly collect their data. The FTC published amendments in the Federal Register on April 22, 2025, which, according to an analysis by the law firm Davis Polk, took effect on June 23, 2025. Most operators had until April 22, 2026, to comply.
The changes are concrete. Operators now need separate parental consent before disclosing children’s data to third parties, with an exception for disclosures integral to the service. The firm notes that disclosures for advertising, payment or AI training would not qualify for that exception. Operators must also maintain a written data retention policy that prohibits indefinite retention, keep a written information security program, and take reasonable steps to ensure third parties protect the data. The amended rule adds biometric identifiers and government-issued identifiers to the definition of personal information.
The Health Breach Notification Rule
Many health and fitness apps fall outside HIPAA, the federal health privacy law that covers doctors, insurers and their business associates. The FTC’s Health Breach Notification Rule fills part of that gap. In April 2024, the Commission voted 3-2 to update it, and the update took effect on July 29, 2024, according to a summary by Morrison Foerster.
The revised rule makes clear that it covers health apps and similar technologies not subject to HIPAA. It also treats an unauthorized disclosure, such as sharing data in ways that conflict with a company’s own statements, as a breach that can trigger notice obligations, even when no hack is involved. This is where store labels and federal enforcement meet: the rule ties what an app says to what it does. Policy developments in this area are tracked in TechAmerica.ai’s government and policy section.
Reading a Label Before You Install
A privacy label is most useful when read with a specific question in mind. Start with the app’s job. A navigation app needs precise location; a calculator does not. A mismatch between what an app does and what it collects is a stronger signal than the length of the list.
Questions worth asking before tapping install include:
- Is any data listed as used for tracking, and does the app’s purpose explain why?
- Which data is linked to your identity, and could the app work with less?
- Does the Google Play listing say data is encrypted in transit and that you can request deletion?
- Does the linked privacy policy name the categories of third parties that receive data?
- For an app aimed at children, does the developer explain how it handles parental consent?
Labels can also be compared over time. Because developers can update Apple’s answers without a new app version, it is worth looking again after major updates or after an app is sold to a new owner. Comparing the Apple and Google listings for the same app can reveal inconsistencies worth questioning, though some differences come from the stores’ own definitions rather than changed behavior.
Labels also say nothing about how well a company protects the data it holds. A short label does not prevent a breach. Readers concerned about that side of the risk can follow incident reporting in TechAmerica.ai’s security section.
What Product Teams Should Build Into Their Release Process
For developers and product managers, the fact that app privacy labels are self-reported makes accuracy a process problem. A label accurate at launch can drift as teams add SDKs, switch analytics vendors, or ship new features. Because both stores hold developers responsible for third-party code, the person filling out the questionnaire needs more than a guess about what each library sends.
A few practices help keep disclosures honest:
- Keep an inventory of every SDK and service in the app, assign an owner to each, and record what data it receives.
- Review the privacy label as part of the release checklist, alongside code review and testing, whenever a dependency is added or updated.
- Inspect network traffic from test builds to confirm what actually leaves the device, rather than relying on vendor documentation alone.
- Collect SDK privacy manifests and compare them with the app’s own declarations.
- Document retention and deletion rules, since the amended COPPA Rule now requires a written retention policy for children’s data.
Teams shipping health, finance, or children’s features should involve legal and privacy counsel early. The labels are a store requirement, but regulators can treat their statements as evidence if they later compare an app’s claims with its conduct.
Where App Privacy Disclosure Goes Next
The trend is toward more specific disclosure and closer attention to third-party code. Apple has said its required reason rules will eventually expand to cover the entire app binary, according to the Bitrise summary. The FTC’s recent rules target the same weak points labels expose: data passed to third parties, data kept too long, and data used in ways users weren’t told about.
For users, app privacy labels remain a quick, useful filter, provided they are read as claims rather than guarantees. For developers, the safest assumption is that someone may one day check every line in a label against what the app actually does. Any gap between the two can cost a developer users’ trust.
Frequently Asked Questions
Do Apple and Google audit app privacy labels before they appear on a store listing?
Neither store independently audits every answer. Google says its review isn’t designed to verify the accuracy and completeness of Data Safety declarations, and that developers alone are responsible. Apple likewise says developers must keep their responses accurate and up to date. Google says it can take enforcement action when an app’s behavior conflicts with what it declared.
Why does the same app sometimes show different privacy information on iPhone and Android?
The two stores use different questionnaires and definitions. For example, Google does not count on-device processing, end-to-end encrypted data, or transfers to service providers the same way Apple does. Apps can also differ between platforms, using different SDKs or features, so some variation is expected and not always a red flag.
If I tap Ask App Not to Track, does the app stop collecting my data?
No. Declining the App Tracking Transparency prompt stops the app from tracking you across other companies’ apps and websites, and the advertising identifier returns all zeros. The app can still collect data needed for its own features, analytics within the same developer’s apps and security purposes, which its privacy label should describe.
Are developers responsible for data collected by advertising or analytics SDKs inside their apps?
Yes. Apple states that developers are responsible for all code included in their apps, and its disclosure guidance covers the practices of third-party partners whose code is integrated. Google’s Data Safety declarations also cover data handled by third-party libraries and SDKs, so a developer cannot exclude a vendor’s data collection from the label.
What is an Apple privacy manifest and how does it relate to the App Store label?
A privacy manifest is a file shipped with an app or SDK that declares the data the code collects and the reasons it uses certain sensitive system APIs. Xcode combines manifests into a privacy report that developers can use to complete App Store privacy details accurately, especially when several third-party SDKs are involved.
What changed for children’s apps under the amended COPPA Rule?
Operators covered by COPPA now need separate parental consent before disclosing children’s data to third parties, except for disclosures integral to the service. They must also maintain a written data retention policy, a written information security program and reasonable oversight of third parties. Most operators had to comply by April 22, 2026.
Does HIPAA protect the data I enter into a fitness or period tracking app?
Often it does not, because HIPAA mainly covers health care providers, insurers and their business associates. Many consumer health apps instead fall under the FTC’s Health Breach Notification Rule, updated in 2024 to clarify that it applies to health apps and treats some unauthorized disclosures as breaches requiring notice.
Can a developer change an App Store privacy label without releasing a new version of the app?
Yes. Apple says developers can update their privacy answers in App Store Connect at any time without submitting an app update. That lets labels reflect changes quickly, but it also means privacy-conscious users may want to check a listing periodically.
Does a short privacy label mean an app is safer than one with a long label?
Not necessarily. A short label may reflect minimal collection, but it may also reflect an incomplete answer. A longer label can come from a developer that disclosed carefully. A more useful test is whether the data listed matches what the app needs to do its job, and whether any of it is used for tracking.