How to Read App Privacy Labels Before You Install

This guide sits in our studio notes on privacy by design. If you want the design reasoning from the maker’s side, start with apps that work without an account. Here the reader comes first: where to find the labels, what the words mean, what a label cannot tell you, and how to read one beside the privacy policy. It is a guide to reading, and nothing in it is a ruling on whether any app meets any law.

Where to find the labels

• On the App Store. According to Apple, each app’s product page shows some of the data types the app may collect, and whether that data is linked to you or used to track you. Apple requires developers to provide this information to submit new apps and app updates.
• On Google Play. The Data safety section appears on the app’s Google Play listing, so you can see it before you install. Google requires all developers with a published app to complete it, including those whose apps collect no data.

Both stores also require a link to a public privacy policy. The label is the short version, and the policy is the long one.

The three questions

You do not need to read every line. Start with these.

1. What is collected? Look at the data types. Apple groups them into categories such as contact info, location, user content, identifiers, purchases, usage data and diagnostics. Google asks developers to list the data types they collect and share, and whether each is required or optional.
2. Is it linked to me, or used to track me? This is where the specific words matter. They are explained in the next section.
3. Can I have it deleted? Google’s form asks the developer whether users can request deletion of their data. Check the answer, and then check the policy for how.

If an app collects nothing at all, the label should say so. Even then, Google requires the developer to provide a privacy policy.

“Collect”, “linked to you” and “tracking” in plain words

These terms have narrow meanings, and the stores define them differently.

Collect. In Apple’s words, collecting means transmitting data off the device in a way that lets the developer or its partners access it for longer than is needed to serve a request in real time. Google’s definition is simpler: collecting means transmitting data from the app off the user’s device. Google adds that data processed only on the device generally is not counted as collected. So an app that keeps your information on your phone and never sends it anywhere may legitimately show less than you expect.

Linked to you. Apple does not give a one-line definition on its page. It says data is often linked to a person’s identity unless protections are put in place before collection to de-identify or anonymise it, and that personal information as defined by privacy laws counts as linked. A label that says data is “not linked to you” is therefore a statement about how the developer handles it, and the policy should explain how.

Tracking. Apple defines tracking as linking data collected from an app about a particular person or device, such as a user ID or device ID, with data from other companies’ apps, websites or offline sources, for targeted advertising or advertising measurement, or sharing that data with a data broker. This is narrower than the everyday meaning. By that definition, the word is about linking with outside data or sharing with a data broker, so counting how an app’s own screens are used is collection of usage data, which the label lists separately.

Sharing. Google describes sharing as transferring the user data collected from the app to a third party. It generally excludes transfers to service providers that process data on the developer’s behalf. Again, the exact meaning is in the definition, not in the word.

What the labels do not tell you

A label is useful, and it is limited. Keep these limits in mind.

• It is the developer’s own declaration. Google’s page says: “You alone are responsible for making complete and accurate declarations.” Apple says the developer is responsible for keeping responses accurate and up to date.
• It is not a full audit. Google states that its review is not designed to verify the accuracy and completeness of declarations. Apple’s page does not describe how it checks them.
• It is a snapshot. Apple notes that developers can update their answers at any time without submitting an app update, so the label can change between versions.
• It is short. A label cannot hold a sentence such as “from version 1.0.7, this runs unless you switch it off”. That kind of detail lives in the policy.
• It does not describe other apps on your phone. Each app’s label covers that app alone.

Reading the policy next to the label

Give yourself five minutes, and read the policy with the label open beside it.

1. Find the short version. Many policies open with a short summary. Read it first.
2. Match each label line to a sentence. If the label says usage data is collected, find where the policy says what is counted and why.
3. Look for what is optional. A good policy says what you can switch off and where.
4. Look for the version. If the wording says “from version X”, check that you have a version that matches.
5. Find the contact route and the deletion route. Both should be easy to find, and both should be written down.

If the label and the policy disagree, treat that as a question, not a verdict. Write to the contact address in the policy, and name the line that differs.

What our own pages show

Each product in our Store has its own privacy policy, written for that product, and a plain-language summary on its page. We do not reproduce store labels here, because a label is meant to be read in the store itself; open the store page of any app and compare it with the policy as described above. Instead, here is how the three questions work on the policy pages, using two of our products: Cuelift’s privacy notice and Gloomrush’s privacy notice.

Notice three things in that table. The wording depends on the version. The answers differ between a tool and a game, because the game carries optional ads. And the table is a summary, so the policy page is the place to read the exact words. You can open each product’s page in the Store: Cuelift and Gloomrush. If you are interested in how analytics choices are asked for inside an app, see asking for analytics consent in an app, plainly. For one worked example of choosing a tracker with no account, there is habit tracker with no account: what you keep and lose.

Questions

What is the Data safety section?

It is the section of a Google Play listing where the developer declares which data types the app collects and shares, why, whether each is required or optional, how data is protected, and whether you can ask for deletion. It is shown on the listing before you install.

What does “data used to track you” mean?

In Apple’s wording, tracking means linking data collected from an app about a person or device with data from other companies’ apps, websites or offline sources for targeted advertising or ad measurement, or sharing it with a data broker.

Are privacy labels checked by the store?

Both stores make the developer responsible for the answers. Google says its review is not designed to verify the accuracy and completeness of declarations. Apple’s page requires the details and does not say how it checks them.

Where is an app’s privacy policy?

Both stores require developers to provide one, and the label is meant to be read next to it. Look for the link on the app’s store page. Each Mobixify product has its own policy, reachable from its page in our Store.

What should I do if the label and the policy disagree?

Treat it as a question. Write to the developer at the contact address in the policy and name the line that differs. Until it is explained, go by the stricter reading, and decide whether you want the app on your phone.