What is the difference between collected and shared data on Google Play?

Collected means the data is sent off the user's device. Shared means data collected from your app is transferred to a third party. Data can be collected, shared, or both.

Is sending data to a service provider sharing?

No. Google lists transfers to a service provider that processes data on your behalf and under your instructions as not sharing. You still declare the data as collected.

Can data be collected and shared at the same time?

Yes. In the form you can select both for a data type, and then give purposes for each.

Collected vs Shared in the Data Safety Form

Short answer: data is collected when it leaves the user’s device, whether it goes to you or to anyone else, including through an SDK. It is shared when data from your app is transferred to a third party. A service provider working for you is not a third party, so sending data to one is collection only. For each data type, the form asks whether it is collected, shared, or both.

Collected

Google defines collection as transmitting data off the user’s device. That includes data sent by libraries and SDKs in your app.

Not collection:

Data processed only on the device, such as a local database or on-device processing.
Data sent with end-to-end encryption that no one in between, you included, can read.

Reading data with a permission doesn’t make it collected either. It becomes collected when the data, or something derived from it, leaves the device.

Shared

Google defines sharing as transferring user data collected from your app to a third party. That covers server-to-server transfers, on-device transfers to another app, transfers through SDKs, and transfers through a WebView your app controls. A third party is any organization other than you (the developer publishing the app) and your service providers.

Google lists these transfers as not sharing:

Exception	Example
A service provider that processes data on your behalf, under your instructions	Your cloud host, a crash reporter or a backend service you pay to store data
A legal purpose	A response to a valid legal request
A user-initiated action the user reasonably expects, or sharing after a prominent in-app disclosure and consent that meets Google’s User Data policy	The user picks another app to send a photo to
Fully anonymized data that can no longer be linked to a person	Aggregated counts with no identifiers

Google’s page also points out that anonymizing data properly is hard, and suggests consulting privacy and security experts. Source: Play Console Help.

How common SDKs fit

What follows is how each vendor’s disclosure is recorded in this project’s SDK knowledge base. Always check the vendor page itself.

Firebase Analytics and Firebase Crashlytics: collected, not shared. The Analytics entry notes that linking Google Ads, Google Signals or data sharing settings can change what is collected and whether it counts as shared, so review those settings.
AdMob: Google’s disclosure lists approximate location, app interactions, diagnostics and device or other IDs as collected and shared.
RevenueCat: purchase history is collected, not shared.
Facebook SDK app events: recorded as shared. That entry is inferred from Meta’s documentation, not a Play-specific disclosure.

CSV IDs

For each data type, the “collected, shared, or both” question is a multiple-choice question. Select both rows for “both”.

PSL_DATA_USAGE_ONLY_COLLECTED: the data is collected.
PSL_DATA_USAGE_ONLY_SHARED: the data is shared.
The purposes for collection go in the DATA_USAGE_COLLECTION_PURPOSE rows and the purposes for sharing in the DATA_USAGE_SHARING_PURPOSE rows, using IDs such as PSL_APP_FUNCTIONALITY, PSL_ANALYTICS and PSL_ADVERTISING.

For approximate location the full question ID is PSL_DATA_USAGE_RESPONSES:PSL_APPROX_LOCATION:PSL_DATA_USAGE_COLLECTION_AND_SHARING.

Common mistakes

Marking every SDK as shared. A vendor that processes data only for you is a service provider. Over-declaring sharing makes your listing look worse than it is.
Marking an ad network as collected only. Ad networks often use the data for their own purposes as well. Read the vendor’s disclosure.
Forgetting your backend. If your server passes user data to another company, that is sharing, even though no SDK is involved. Code in the app can’t show this.
Filling sharing purposes for data that isn’t shared, or the reverse.

With data-safety-from-code

The skill takes collected and shared values for each SDK from the vendor’s disclosure, and links that page as evidence in its report. For your own code, the agent follows the data at each flagged file:line and records why it decided collected, shared or both. It also asks you directly whether your backend sends any of the data to third parties. Get started.

Want the form filled from your own code, with evidence? Install the skill. If this page helped,star the repo on GitHub.

Built by Sanikant. Set in Google Sans Flex (SIL Open Font License), icons from Material Symbols (Apache 2.0). Google Play is a trademark of Google LLC; this project is not affiliated with Google. Output is a draft for review: you are responsible for your Data safety declaration.