PeerPlay
If your app uses Firebase or AdMob, you have to declare the data those SDKs collect in Play Console's Data safety form, even though your own code never touches it. Google publishes a disclosure page for each SDK, and the form should match what those pages say plus whatever your own app collects.
This guide summarises those pages for the most common SDKs as of November 2026. SDK versions change what they collect, so treat it as a starting point and check the pages for the versions you actually ship. The form is in Play Console under App content, Data safety.
AdMob (Google Mobile Ads SDK)
Google's AdMob disclosure page says the SDK collects and shares these data types automatically, for advertising, analytics and fraud prevention: the device's IP address, which may be used to estimate general location; user product interactions such as app launch, taps and video views; diagnostic information such as app launch time, hang rate and energy usage; and device and account identifiers, including the Android advertising ID and app set ID.
In the form these usually map to Approximate location, App interactions, Diagnostics and Device or other IDs. Because the page says collected and shared, mark them as shared too, with advertising or marketing, analytics and fraud prevention among the purposes.
The page also says all data is encrypted in transit and that ad ID collection is optional for the user, who can reset or delete it in Android settings.
Google Analytics for Firebase
Google's Analytics disclosure page lists these as collected automatically: an app-instance ID, the Android advertising ID, coarse location derived from masked IP addresses, in-app purchase and subscription events with product ID, name and price, and app lifecycle events such as screen views and sessions.
In the form that usually means Device or other IDs, Approximate location, App interactions, and Purchase history if you sell in-app products. If you set a User-ID or turn on Google signals, more data is collected, so check those settings.
Google's guidance for the form treats data sent to a service provider that processes it on your behalf as collected, not shared. Firebase says it only passes this data to its subprocessors or according to your instructions.
Crashlytics, Auth, Cloud Messaging and Performance
Crashlytics collects stack traces, relevant app state and device metadata when the app crashes, plus a Crashlytics installation UUID. That maps to Crash logs, Diagnostics and Device or other IDs. Custom keys, logs and user IDs you add yourself must be declared too.
Firebase Authentication collects the IP address for security and abuse prevention, plus whatever the sign-in method needs: email address, phone number, display name and a Firebase user ID. Declare the ones your sign-in methods use under Personal info and Device or other IDs.
Cloud Messaging collects the app version and a non-identifying user agent to deliver messages. Performance Monitoring collects performance metrics, CPU and memory usage, device metadata and the IP address to map events to countries.
Firebase says all of this is encrypted in transit over HTTPS, and that developers can delete end-user data in line with each service.
Questions the form asks about everything
Is all user data encrypted in transit? With these SDKs it is, according to Google, but the answer covers your own servers too, so only say yes if they use HTTPS as well.
Can users ask for their data to be deleted? If your app has accounts, Google Play also requires a way to delete the account and its data, in the app and on the web.
Is collection required or optional? Data your app can't work without is required. Data users can turn off, such as the advertising ID, can be optional.
Before your closed test
Fill in the Data safety form before you send your first closed testing release for review, because Play Console checks it with the rest of your app content. If you add AdMob or a new Firebase product later, update the form in the same release.
If you need 12 testers once the release is live, PeerPlay is a free way to find them: Android developers test each other's apps every day through your real closed track.
FAQ
Do I have to declare data collected by Firebase and AdMob?
Yes. Data collected by SDKs in your app counts as data your app collects, so it belongs in the Data safety form.
Is AdMob data collected or shared in the Data safety form?
Google's AdMob disclosure page says the SDK collects and shares IP address, app interactions, diagnostics and device IDs, so declare them as both.
Does Firebase Analytics collect location?
Google's Analytics page says it derives coarse location from masked IP addresses. It doesn't collect precise location.
Where is the Data safety form in Play Console?
Under App content, then Data safety, for each app in your developer account.