App content is the section that stops a finished app from shipping. None of it is hard, but several answers are cross-checked against each other and against your actual build, and mismatches are treated as policy violations rather than mistakes.
Privacy policy
A public URL that loads without a login, is not editable by visitors, and names your app. It must also be reachable from inside the app for most permission sets. See the privacy policy generator if you need one that matches the SDKs you actually ship.
Ads
A single yes/no: does your app contain ads. Answer yes if you ship AdMob, any mediation SDK, house ads, or sponsored content. It adds an "Contains ads" badge to your listing.
Declaring no while shipping an ad SDK is one of the easier violations for Google to detect automatically.
App access
If any part of your app is behind a login, a paywall, a region lock or a feature flag, you must supply working credentials so reviewers can see it.
This is the most common cause of a silent rejection. Practical notes:
- Create a dedicated review account that does not expire and is not rate-limited.
- If you use OTP login, provide a test number with a fixed code, or a bypass for that account.
- Write step-by-step instructions, including anything non-obvious ("tap the logo five times to reveal the debug entry").
- Re-check the credentials before every submission. Expired test accounts cause rejections on apps that were previously approved.
Content rating questionnaire
A questionnaire that produces regional ratings (IARC, ESRB, PEGI and others). Answer honestly — under-declaring violence, gambling, or user-generated content is a policy violation, and the rating can be re-evaluated at any time.
The question people answer wrongly: user-generated content. If users can post anything other people see — comments, profiles, chat, uploads — the answer is yes, and it brings moderation obligations with it.
Target audience and content
You select the age groups your app targets. Including anyone under 13 puts you in the Families programme, which brings real constraints:
- Advertising must come from a Families-approved ad SDK.
- You cannot use the advertising ID for personalised ads.
- COPPA compliance is required, and GDPR-K where relevant.
- Your privacy policy needs children-specific disclosures.
Do not tick a child age group casually to widen reach. It is a substantially different compliance regime.
Data safety
The form that becomes the public "Data safety" card on your listing. Because users see it, inaccuracy is enforced as a violation.
Fill it from a written list of every SDK in your build, not from memory. The distinctions that matter:
- Collected means data leaves the device to you. Shared means it goes to a third party — ad SDKs almost always mean shared.
- Ephemeral means processed in memory and never persisted. Crash logs written to a service are not ephemeral.
- Device or other IDs covers the advertising ID and installation IDs — if you ship AdMob or Firebase, declare it.
- Approximate location includes IP-derived location, even with no location permission.
Every answer here must agree with your privacy policy. That cross-check is where most User Data rejections come from.
Government apps, financial features, health
These appear conditionally and each carries extra documentation requirements. Financial features in particular — lending, payments, crypto, insurance — require licensing evidence in many countries and are a frequent cause of long review holds. If your app touches these, read the category policy in full before you submit, not after.
News apps
Declaring your app as a news app requires editorial ownership details and publisher information. If you aggregate other publishers' content, make sure you have the right to do so.
Keeping it true over time
App content is not one-time. Every time you add an SDK, revisit Data safety and Ads. A common enforcement story: a developer adds a monetisation SDK in version 12, never updates the declarations, and receives an enforcement notice months later. Put "review App content declarations" on your release checklist.