Most Google Play enforcement is predictable. The same policy areas account for the bulk of rejected updates, removed apps and terminated accounts, and in almost every case the problem was visible before submission. This is a map of those areas as they stand in 2026, what triggers each one, and what to do instead.
How enforcement escalates
| Action | What it means | What to do |
|---|---|---|
| Rejection | An update or new app is not published; the live version, if any, stays up | Fix the cause, resubmit, and keep evidence of the fix |
| Removal | The app is taken down from Google Play until it complies | Fix, resubmit, and appeal if you believe the decision is wrong |
| Suspension | A serious or repeated violation; suspensions count against the account | Treat as urgent; repeated suspensions can end the account |
| Account termination | All the developer's apps are removed and the account closed | Appeal through the official process; never open a new account to get around it |
The last row matters more than it looks. Google terminates accounts it associates with previously terminated ones, so a developer who responds to a ban by registering a new account usually loses that one too, sometimes with every client app in it.
Store listing and metadata
- Triggers: keyword stuffing, anonymous testimonials, claims about ranking or awards, price or promotional words in the app name or icon ("free", "best", "#1", "sale"), screenshots that do not show the actual app, descriptions of features that do not exist.
- Also here: impersonation and intellectual property. Using another company's brand, logo or product name in a way that suggests affiliation is a fast route to removal.
- Do instead: describe what the app does, show real screens, and keep marketing claims for places that are not the listing.
Spam and minimum functionality
- Triggers: apps that wrap a website in a web view without adding app functionality, apps built from a template with only the content swapped, many near-identical apps from one developer, apps that crash, fail to load or show no content without explanation.
- Do instead: give the app functions a website cannot provide, such as offline use, device features or notifications with a real purpose, and publish one well-made app rather than ten thin ones.
Sensitive permissions and APIs
The permission policies change more often than any other area, and several changes have deadlines in the next few months:
| Permission or API | Rule in short |
|---|---|
| SMS and call log | Only for the default handler or a permitted core use, declared in Play Console. From 27 January 2027, account verification by phone call is no longer a permitted use of the call log permission; use the Digital Credentials API or the SMS Retriever API instead. |
| Location in the background | Needs a core feature that users would expect, a declaration, and a prominent in-app disclosure before the permission request. Google is also introducing a location button as the recommended minimum scope for precise location. |
| Contacts | From 27 January 2027, apps are directed to the Android Contact Picker instead of broad access to the contact list. |
| Photos and videos | Broad media permissions are for apps whose core purpose needs them; others use the system photo picker. |
| All files access, package visibility, accessibility | Each is limited to specific qualifying uses and needs a declaration. Using the accessibility service for anything other than helping users with disabilities is a common cause of removal. |
| Foreground services | Each service type must be declared and justified. From 27 January 2027, geofencing is no longer an approved foreground service use; use the geofencing API. |
The rule behind all of these: request the narrowest permission that does the job, only when the feature needs it, with an explanation the user sees first.
User data
- Privacy policy: required, live, linked from the listing and inside the app, and consistent with what the app does.
- Prominent disclosure and consent: required before collecting personal or sensitive data in ways users would not expect.
- Data safety accuracy: the declaration must match the behaviour of the app and every library in it.
- Account deletion: apps that allow account creation must let users request deletion inside the app and through a web link.
- Third-party AI: the July 2026 policy update made explicit that the User Data policy applies to data sent to third-party AI services: limited use, disclosure and consent apply exactly as they do to any other recipient.
Deceptive behaviour and security
- Apps must not hide functionality, impersonate system messages, or behave differently during review from how they behave for users.
- Apps distributed through Google Play may not download executable code from sources other than Google Play to change their behaviour.
- Ad fraud, click injection and misuse of device resources lead to removal and, often, termination.
Ads
- No full-screen ads that appear unexpectedly, interrupt a user's action or cannot be closed.
- No ads that imitate system notifications or app interface elements.
- No ads on the lock screen unless that is the app's exclusive purpose.
- Apps directed at children may only use advertising that meets the Families policy.
Children, chat and user-generated content
Apps that target children must meet the Families policy requirements for content, advertising and data collection. Apps in the social and dating categories must publish child safety standards and give users an in-app way to report concerns. In July 2026 Google extended these requirements to anonymous and random chat apps and prohibited such apps from targeting children, with compliance due by 26 August 2026. If your product connects strangers, moderation is part of the product, not an afterthought.
Money: financial services, gambling and prizes
- Financial services. Loan, credit, crypto and similar apps face specific disclosure and licensing requirements, which vary by country. The July 2026 update added transparency requirements for earned wage access apps.
- Real-money gambling and games. Allowed only in eligible countries, with the required licences and Google's approval; otherwise prohibited.
- Entry fees and prizes. A game in which users pay to enter and can win money or valuable prizes is, for policy purposes, a real-money game until an expert tells you otherwise, whatever its genre. Settle this with legal advice before building the payment flow, not after the first rejection.
If you are rejected or removed
- Read the notice in the Policy status section of Play Console: it names the policy and often the specific issue.
- Fix the cause in the app, not only in the listing or the declarations.
- Resubmit with a clear note of what changed.
- If you believe the decision is wrong, appeal through the official form with evidence.
- Keep a record. Patterns in your own history are the best guide to what to check next time.
Most of these checks apply equally to Apple's review, and the general causes of first-submission rejections are in the predictable rejections. For the account and testing side of a first release, see how to publish on Google Play in 2026 and the 12-tester closed test.
Related Manboo Services
- Android App Development, including Play Console set-up, release tracks and policy declarations.
- iOS App Development, including App Store Connect, TestFlight and App Review preparation.
- Flutter App Development when one codebase must pass both stores' reviews.
- Software Maintenance for existing apps that need target API, SDK or policy updates.
- Request a scope review and estimate for a store launch or a rejected submission.