Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement states that Google may share personal data including name and email address with Content Providers to process transactions or deliver Content, with Providers obligated to use the data per their own privacy policies. Separately, the terms disclose that device identifiers including SIM subscriber ID and SIM serial number are transmitted to the user's mobile network operator to determine billing eligibility.
This analysis describes what Google Play Store's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes two distinct personal data sharing flows: transaction-related sharing of name and email with Content Providers governed by each Provider's independent privacy policy, and transmission of device-level SIM identifiers to mobile carriers for billing eligibility. Under this clause, the data protection standards applicable to shared information vary by recipient and are not uniformly governed by Google's Privacy Policy.
Interpretive note: The legal basis and specific data handling standards applicable to Provider-side data use are not specified in this document, creating uncertainty regarding the level of data protection users can expect from third-party Providers.
Expanded data sharing scope to include device identifiers and SIM information shared with mobile carriers upon account creation.
View full change record →Under this provision, personal data including name and email may be disclosed to third-party Content Providers whose privacy practices are governed by their own policies rather than solely by Google's Privacy Policy. Additionally, device identifiers (SIM subscriber ID and SIM serial number) are transmitted to the user's mobile network operator when a Google Play account is created on a device to assess carrier billing eligibility.
How other platforms handle this
If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data.
Right to the portability of your personal data
If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).
Monitoring
Google Play Store has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Google có thể cần cung cấp thông tin cá nhân của bạn, chẳng hạn như tên và địa chỉ email của bạn, cho Nhà cung cấp để xử lý giao dịch của bạn hoặc cung cấp Nội dung cho bạn. Các Nhà cung cấp đồng ý sử dụng thông tin này theo chính sách bảo mật của họ. [...] khi bạn tạo tài khoản Google Play trên Thiết bị, chúng tôi sẽ gửi thông tin nhận dạng của Thiết bị của bạn, như ID người đăng ký và số sê-ri trên thẻ SIM tới nhà cung cấp mạng của bạn.Excerpt from Google Play Store's Google Play Terms
(1) REGULATORY LANDSCAPE: This provision engages GDPR (for EU users) regarding the lawful basis and transparency requirements for sharing personal data with third-party Controllers (Content Providers), and potentially Article 28 processor obligations if Providers act as processors. The transmission of SIM identifiers to mobile network operators constitutes processing of device-level personal data and may require evaluation under GDPR and ePrivacy Directive requirements. In the US, the FTC Act governs unfair or deceptive data practices, and CCPA provides California residents with disclosure rights regarding personal data sharing with third parties. (2) GOVERNANCE EXPOSURE: Medium. The provision that Providers use shared personal data per their own privacy policies means users are subject to multiple, independently operated privacy regimes when purchasing Content from third-party Providers. The SIM identifier transmission is disclosed but the legal basis, retention period, and recipient data practices are not specified in the ToS document. (3) JURISDICTION FLAGS: EU and EEA users have heightened exposure; GDPR requires that cross-controller data sharing be disclosed with specificity regarding purpose, legal basis, and recipient identity. California users have CCPA rights to know about and opt out of certain personal information sharing. The SIM identifier transmission may trigger specific consent requirements under national ePrivacy implementations in EU member states. (4) CONTRACT AND VENDOR IMPLICATIONS: Organizations using Google Play for enterprise Content procurement should assess whether personal data of employees or managed users is being shared with third-party Providers and whether this sharing is consistent with internal data protection policies and GDPR data processing agreements. (5) COMPLIANCE CONSIDERATIONS: Data protection officers should review whether the disclosure of SIM identifier transmission in the ToS, rather than through a specific consent mechanism, satisfies applicable legal basis requirements. The reliance on Provider privacy policies to govern shared personal data should be assessed for adequacy, particularly regarding GDPR accountability obligations. Data mapping exercises should include third-party Content Provider data flows.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes two distinct personal data sharing flows: transaction-related sharing of name and email with Content Providers governed by each Provider's independent privacy policy, and transmission of device-level SIM identifiers to mobile carriers for billing eligibility. Under this clause, the data protection standards applicable to shared information vary by recipient and are not uniformly governed by Google's Privacy Policy.
Under this provision, personal data including name and email may be disclosed to third-party Content Providers whose privacy practices are governed by their own policies rather than solely by Google's Privacy Policy. Additionally, device identifiers (SIM subscriber ID and SIM serial number) are transmitted to the user's mobile network operator when a Google Play account is created on a device …
ConductAtlas has identified this type of provision across 294 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Google Play Store.