Data Safety Form for Firebase and AdMob: What to Declare
If your app uses Firebase or AdMob, you have to declare the data those SDKs collect in Play Console's Data safety form, even though your own code never touches it. Google publishes a disclosure page for each SDK, and the form should match what those pages say plus whatever your own app collects. This guide summarises those pages for the most common SDKs as of November 2026. SDK versions change…
When an app incorporates Firebase or AdMob SDKs, the corresponding data safety declaration must be completed in Google Play Console. Even though the SDKs' data collection happens independently of the app's own code, the disclosure form must align with the information provided by Google. The guide below summarizes the data safety disclosures for the most common Firebase and AdMob SDKs as of November 2026, acknowledging that SDK versions can change the data collected.
For AdMob (Google Mobile Ads SDK), the disclosure mentions the automatic collection and sharing of the device's IP address (potentially used for general location estimation), user interactions like app launches and taps, diagnostic information such as device performance metrics, and device identifiers like the Android advertising ID. Since the page specifies these data types are shared, they should be marked accordingly with purposes like advertising, analytics, and fraud prevention.
Google Analytics for Firebase collects an app-instance ID, Android advertising ID, coarse location data from masked IP addresses, in-app purchase and subscription events with details like product ID and price, and app lifecycle events (screen views and sessions). This typically maps to Device or other IDs, Approximate location, App interactions, and Purchase history in the form, unless additional data like User-ID or Google Signals are enabled.
Crashlytics gathers stack traces, app state, and device metadata at the time of a crash, mapped to Crash logs and Device or other IDs in the form. Custom keys, logs, and user IDs added by the developer must also be declared. Firebase Authentication logs an IP address for security purposes and collects the sign-in method details (email, phone number, display name) along with a Firebase user ID. Any additional data from custom sign-in methods should be declared in the Personal info and Device or other IDs sections.
Cloud Messaging logs the app version and a non-identifying user agent for message delivery and Performance Monitoring records performance metrics, CPU and memory usage, device metadata, and the IP address for country mapping. Firebase asserts that all data is encrypted during transmission over HTTPS, but confirms that developers should also ensure their own servers use HTTPS. The form requires confirmation that user data is encrypted in transit, and if users can opt-out of certain data collection like the advertising ID.
Before submitting the first closed testing version, the Data safety form must be completed in Play Console, as Google's checks include this form alongside the rest of the app content. If additional AdMob or Firebase products are integrated later, the form should be updated within the same release. Finally, if the app enters closed testing with 12 testers, PeerPlay offers a free platform for finding Android developers to test each other's apps via a real closed track.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
