The Safe Browsing team is laying out new restrictions on how apps collect a user’s data. Under the new policy, apps must provide their privacy policy and prompt users to share their data. This applies to everything from a user’s phone number to the list of apps installed on the phone.
Applications which collect and transmit personal data not required for the app to function must tell users how the data will be used.
If an app collects and transmits personal data unrelated to the functionality of the app then, prior to collection and transmission, the app must prominently highlight how the user data will be used and have the user provide affirmative consent for such use.
The new requirements will apply to all functions of an app. For example, if an application wants to send analytics or crash reports, it cannot transmit the list of installed packages unrelated to the app unless it discloses that and gets permission from the user.
Developers and webmasters have 60 days to implement changes before Google will step in and warn users.Interestingly enough, apps downloaded outside of the Play Store are subject to this policy too. No matter where it comes from, the app must follow the policy or Google Play Protect will show a warning whenever it tries to collect your data without telling you. Google will also show the familiar red warning boxes when you try to visit a website that distributes an offending app.