[MUSIC PLAYING]
TINA SRISKANDARAJA: Hi, everyone.
My name is Tina, and I'm a product
manager on Google Play's app safety,
privacy, and security team.
Today I'm going to talk about Play's new data safety section
and how we're working to improve data transparency to users.
So why are we even talking about this?
This image captures what many of us
may have felt at one point or another.
We know there's a lot of information out there
about apps, the data they collect, handling security
practices, and more.
It could be hard for any user to find this information,
read through it all, and make sense of what it means.
When we talked to users, we found that this sentiment
was pretty spot on.
There is an overwhelming amount of information
at varying degrees of ease to find
if a user wants to know more about an app's data practices.
For example, one of our research studies showed that over 75%
of US users found data collection either not at all
to only somewhat transparent.
We believe we can and should do better.
We heard from users that there is a lot of information
to navigate, but we also wanted to understand what
would be most helpful to them.
So when we asked, users told us that they
care most about what information is collected about them,
how will this data be used, how much control do they have,
and what security practices are keeping their data safe?
Here's a quote from one of our users we spoke with.
We know that data and security won't be the only consideration
to a user, but our goal in making this information more
discoverable and easy to understand
is that users can see it and use it
to make more informed choices about the apps they install.
Keeping users safe is core to what we
do on Android and Google Play.
As we iterate on our products and policies,
we continue to build on an existing foundation that
supports user trust.
Here are a few of our guiding principles
that we want to provide users with, transparency
and controls around what data is accessed
by apps across different touchpoints in a user's
journey.
Data minimization, which refers to limiting the scope
of data that's accessed to what users really need.
You play a key role here in ensuring that data
that your app accesses is actually needed.
Last but not least, there's data security.
That includes measures that you and Google
take to keep apps and user data safe.
How can we provide more privacy and security
information in a helpful way to users, you may be wondering.
Well that's where you come in.
We know that you and your teams already
have a lot on your plates, so I want
to share why this matters to your app and your users.
There are already several ways that you
engage users about data privacy and security.
Your app may have a privacy policy.
It may surface a prominent disclosure within the app,
or it may prompt a user for consent
through a runtime permission.
We want to build on these existing
measures within the app and within contexts
that help users understand their data access,
but we want to focus on before the point of app installation.
This is a moment where users are looking to learn more
about your app, its benefits, and what
they could expect in terms of data of theirs
that may be collected.
We're really looking to complement all the activity
and engagement that happens within the app.
Research shows that the more informed users are,
the more likely they are to engage.
For example, one recent study showed a decrease
by over 50% of the deny rate by users
when permission requests were provided with an explanation.
We want to provide relevant user data and security information
so that users can make the right choices for themselves.
So let's take a look at a quick video about the new Play data
safety section.
[MUSIC PLAYING]
Cool video.
I hope you enjoyed it.
Let's take a closer look.
We're adding a data safety section
on the Play Store which will describe
what data is collected, shared, and the security practices that
are followed.
Our goals through this new feature
are to support users making informed decisions
about the apps they install and use
and also to give developers a canvas
to showcase their approach to privacy and security.
The new feature will highlight developer practices
such as whether the data is encrypted in transit,
whether the app has undergone an independent review of security
practices.
It'll also provide terms that are simple and avoids jargon
so that we're maximizing user understanding.
It'll also allow for relevant and helpful contexts,
such as if collection is optional.
These are some illustrative examples
that are subject to change, but let's walk through what
this looks like to the user.
At a glance, users will see a summary of key information,
such as if any user data is collected or shared
and whether the data is encrypted in transit.
Users can click in to learn more.
When they do, users will see that this information has
been provided by you, as well as some contexts
that actual data practices may vary.
Users will be shown this information
in two clear categories, what user data is collected,
and what user data is shared with third parties.
The Play help center provides more information
about these terms and how to complete the data safety
section.
A user can click on the specific data type
to see an expanded view, which enables them to get more
context of interest to them.
Users can also get more context on purposes, as well as
if the collection is optional.
If your app doesn't collect or share any user data,
you'll still need to complete a data safety section,
and we'll show users that your app doesn't
collect any of their data.
While we want everyone to complete this new form
by February 2022 when users can start to see it in the Play
Store, if you're still working on it,
this placeholder is what will be shown to users.
I'm going to go through a quick illustrative example of what
you could expect.
Say your app collects user location data,
and it collects and shares users' health information.
Both of these data types would need
to be disclosed in your new data safety section form.
You can make these selections for your app
under app content in Play Console.
Here you'll be able to disclose app level
selections, such as if the data is encrypted in transit,
as well as specific user data types that
may be collected and/or shared along with the purposes.
We heard from other developers that being
able to replicate forms across multiple apps would be helpful,
so we're also supporting the ability for you
to import your information through a CSV
file and the ability to copy over disclosure
across multiple apps when they have the same collection
and sharing practices.
Now I'm going to hand it over to Rustin
to share more about policy updates and resources.
RUSTIN BANKS: Thanks, Tina.
Let me touch on a few policy updates that have accompanied
the data safety section.
First, Play's user data policy has been updated to state
that you must fill out a data safety form in the Google Play
console for each one of your apps.
And you're responsible for the accuracy of the section
and keeping it up to date.
Also, please make sure your information
is consistent with your app's privacy policy.
And speaking of privacy policies,
the requirements for privacy policies have been updated too.
Now all apps must have a privacy policy link in Play Console
and post a privacy policy in the app.
The privacy policy should accurately
disclose how your app accesses, collects, uses,
and shares user data.
And for more details on what a privacy policy must include,
things like privacy point of contact, data
retention/deletion policies, you can see the user data policy.
So as a reminder, every app already
has a target audience and content section
within the Google Play console.
And this is where you declare the age ranges of your target
audience.
Well, with the new data safety section,
apps whose target audience include children,
they'll need to declare that they follow
Google Play Families policy.
And then when we launch the data safety section
and Play Store listings in February next year
or shortly after that launch, we'll
highlight if the app is committed to follow
our Families policy.
Well, you might be wondering, what
is the Play Families policy?
So the Play Families policy is a special collection
of requirements that apply only to apps who include children
in their target audience.
And some of the policy highlights
include things like only Google Play certified ad SDKs
should be used to show ads to children.
So Google Play certified ad SDKs are these ad SDKs
that have self-certified their compliance with special ad SDK
certification requirements.
And apps targeting kids should also
avoid any other SDKs that are not
approved for use in child-directed services
when the user is a child or of unknown age.
And the remaining policies can be found in the policy center.
All right.
This might be a good time to remind apps targeting children
that the data practices section of the Families policy
was recently updated.
So when it comes to identifiers, it's always best
to use resettable IDs.
And now this update prohibits the use
of certain device identifiers.
Starting April 1, 2022, apps targeting children
must not transmit the Android Advertising ID when the user is
a child or of unknown age.
Take a look at our new help center article
to help with your compliance efforts.
Thank you so much for your time today.
We leave you with just a few quick parting thoughts.
First, if you need any more information,
please check out our help center at the link
shown on the screen.
And second, this might be a good time
to start to get to know your SDKs
and how they collect and share data
so that you can fill out your data safety section properly.
Then last, for timeline, developers
can start declaring information in the Google Play
console today, then users will start
to see the labels in February of 2022,
then developers will have until April of 2022 to declare
their data information.
Thank you so much for taking this journey to improve privacy
and security with Android.
[MUSIC PLAYING]