Data safety labels versus the manifest

A Play listing carries two boxes that look like they answer the same question. The Data safety section says what data the app collects and shares. The App permissions list says what the app can technically do. People read the first and assume it is the second. Google's own documentation, on both the developer side and the user side, says they are not.

What Google says about Data safety

From the developer help page, "Provide information for Google Play's Data safety section", as read on 2026-09-06:

"All developers that have an app published on Google Play must complete the Data safety form."

"You alone are responsible for making complete and accurate declarations."

"Google's review process is not designed to verify the accuracy and completeness of your data safety declarations."

That is a self-declaration, and Google is explicit that it does not verify it. The same page defines the terms: "collected" means "transmitting data from your app off a user's device", and it excludes on-device-only processing. "Shared" means transferring collected data to a third party.

From the user-side page, "Understand app privacy & security practices with Google Play's Data safety section":

"Developers use the Data safety section to share information about how their app handles your data."

And on the independent security review badge some apps carry, the page notes that the review "does not verify the accuracy and completeness of the developer's Data safety section disclosure".

What Google says about the permission list

Same developer page:

"Google gathers information for the permissions list based on the install-time permissions that an app declares in its manifest. The data safety section shares what data the app collects and shares with third parties."

Same user page:

"This list is based on technical information that describes how the developer's app works. It's different from the Data safety section, which is based on information declared by app developers."

So one box is a form the developer fills in and Google does not check. The other is read by Google from the binary. When they disagree, the second one is the one that describes the app.

Where they can disagree

Three cases, none of which needs bad faith.

An app declares "no data collected" and holds INTERNET. Perfectly consistent under Google's definitions: the form is about what the developer says the app does, and the permission is about what it could do. It may be entirely true today. It is also true only until the next update, and you would learn about a change from the form, which Google does not verify.

An app's library changes what it sends. The form covers "data from libraries, SDKs, and webviews under the app's control", per the developer page, so the developer is responsible for what an advertising SDK does. Developers do not always know. The permission list would show the SDK's permissions regardless.

An app declares collection it does not do. Over-declaring is allowed and harmless to the user. It just makes the form less informative.

How to read a listing, then

1. Read the permission list first. Play listing, About this app, App permissions, See more. Look under Other for "have full network access". That line is Google reading the manifest.
2. Then read Data safety, knowing it is the developer's account, unverified, and legally theirs to get right.
3. If the first says the app can reach the network and the second says nothing is collected, that is a promise, and you can decide what a promise from that developer is worth.
4. If the first says the app cannot reach the network, the second is redundant. There is nothing left to declare.

None of this is a criticism of the form. It is the right mechanism for the vast majority of apps, which do need the network and do have to describe what they send. It is just not the mechanism that answers "can this keyboard send what I type", and Google's own pages are careful not to claim it is.

Why this matters more for keyboards

A weather app that lies on its form leaks your location. A keyboard that lies on its form leaks everything. The class of app where the difference between "declares no collection" and "cannot collect" is largest is the class that reads every character you type, which is why every keyboard post on this site points at the permission list rather than the label.

The label is a sentence. The manifest is a fact. Play prints both, and only one of them is about what the app can do.