Why was my Google OAuth verification rejected for the privacy policy?

Common causes are a policy on an unverified domain, an app name that does not match the consent screen, or a policy that doesn’t describe the Google data you request. Check the User Data Policy.

Does basic Google Sign-In need a privacy policy?

Google’s consent screen asks for a privacy policy link, and the User Data Policy requires accurate disclosure of the data you request.

Google API Services · Platform guide

Privacy policy for Google Sign-In and OAuth apps

If your app uses Google Sign-In or other Google APIs, Google’s API Services User Data Policy requires you to clearly and accurately explain what user data you request and how you use it. For scopes covered by Limited Use, you may only use the data to provide or improve prominent user-facing features, and transfers are restricted.

§ 1

What Google API Services requires

API Services User Data Policy — Transparency

“You must provide clear and accurate information explaining the types of data being requested.”

Source: developers.google.com verified 2026-10-30

1.1New uses need a policy update. Google’s policy addresses data “that was not originally disclosed in your privacy policy (or in-product disclosures)”: update your policy and ask users before such new uses. Source: developers.google.com

1.2Limited Use. For covered scopes: “Limit your use of data to providing or improving user-facing features that are prominent in the requesting application's user interface”. Source: developers.google.com

1.3Accurate identity. “All permission requests must accurately represent the identity of the application that seeks access to user data.” Use the same app name in the consent screen and policy. Source: developers.google.com

§ 2

What common SDKs collect

SDK / API	Data it collects	Source
Google Sign-In basic scopes	openid: associates the user with their Google personal info userinfo.email: primary Google Account email address userinfo.profile: personal info, including public profile info	Source: developers.google.com

Everything in this table must appear in your policy if the SDK ships in your build.

§ 3

Where to put the URL

3.1Google Cloud Console → your project’s OAuth consent screen (branding) → Privacy policy link, on a domain you verify.
3.2Your app’s sign-in page and Settings.

§ 4

Sample clause

§ 4.1 · Google account data

If you sign in with Google, we receive your Google account ID, name, email address and profile picture. We use them only to create and secure your account. We do not use Google user data for advertising and do not sell or transfer it, except as needed to run the service or as required by law.

Illustrative wording. Your generated policy is written from your own answers.

§ 5

Questions

Why was my Google OAuth verification rejected for the privacy policy?: Common causes are a policy on an unverified domain, an app name that does not match the consent screen, or a policy that doesn’t describe the Google data you request. Check the User Data Policy.
Does basic Google Sign-In need a privacy policy?: Google’s consent screen asks for a privacy policy link, and the User Data Policy requires accurate disclosure of the data you request.