Account deletion requirements on Google Play
What Google expects when a user wants their account and data gone, and the page most submissions forget.
What is actually required
Google Play requires two things: a way to request deletion inside the app, and a web page that describes the same route, reachable without installing the app or signing in. The second one is what most rejected submissions were missing.
What the page has to say
- Which account the request is about and how someone starts it.
- What gets deleted, and how quickly.
- What is kept anyway, and the reason: invoices for tax law, logs for security, backups until they rotate.
- How long that retention lasts, in a number rather than "as required".
- An address for someone who cannot use the route for any reason.
Keeping it true after launch
A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. No store re-checks your pages against your build, so the drift is yours to notice.
- Re-read it whenever you add a dependency that sees user data.
- Re-open the Google console after any change to what the app collects: the listing and the policy have to agree.
- Keep the URL stable. Changing where a policy lives breaks every listing that points at it.
Common questions
Can I keep anything after a deletion request?
Yes, where another law requires it. Invoices are the usual example. What you cannot do is keep it quietly: the page has to name what survives, why, and for how long.
Does an email address count as a deletion route?
Not on its own for Google Play. There has to be a route the person can follow themselves, in the app and on the web.