# Permissions you never declared — what to check before filing Play's Data safety form

（[日本語](android-permissions-data-safety.md)）

Google Play's Data safety form is a declaration of **what your app actually collects.**
If it disagrees with what the app does, **your release is blocked as a policy violation.**

The awkward part: **reading `AndroidManifest.xml` won't tell you the real permission list.**
Permissions pulled in by libraries appear nowhere in it.

Below is what five Flutter / Android apps actually shipped with, and how to check yours.

---

## How far the declaration diverges from reality

Measured across five shipping apps.

| App | Declared by hand | Actually shipped |
| --- | --- | --- |
| Ads + cloud sync | `INTERNET` only | **10** |
| Billing + system integration | a few | **8** |
| Billing, network only for billing | 2 | **7** |
| Billing, offline game | **0** | **4** |

**Even the offline game shipped four** — with not one line in its manifest.

They came from the billing library (`in_app_purchase`):

```
com.android.vending.BILLING
INTERNET
ACCESS_NETWORK_STATE
<applicationId>.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
```

---

## What actually affects the form: advertising

Adding an ads SDK (AdMob / `google_mobile_ads`) pulls in these four:

```
com.google.android.gms.permission.AD_ID
com.google.android.gms.permission.ACCESS_ADSERVICES_AD_ID
com.google.android.gms.permission.ACCESS_ADSERVICES_ATTRIBUTION
com.google.android.gms.permission.ACCESS_ADSERVICES_TOPICS
```

**`AD_ID` means you use the advertising ID**, which **you must declare** in the Data safety form.

Conversely, **an app with billing but no ads SDK never gets them.**
It isn't "billing means you declare the ad ID" — **it's decided by which SDKs are present.**

---

## Check the AAB, not the APK

This is the easiest thing to get wrong.

**Google Play receives and distributes an AAB (Android App Bundle).**
An APK is carved out of it, and **a different configuration contains different things.**

In practice: comparing permissions before and after an SDK upgrade,
**the APK appeared to lose three** (`DUMP`, `BIND_JOB_SERVICE`, sign-in's `REVOCATION_NOTIFICATION`),
while **the AAB was byte-for-byte identical across the upgrade.**

**Those three were the difference between APK and AAB — not the effect of the upgrade.**

### Reading an AAB

`aapt2` cannot read an AAB. **Use `bundletool`.**

```
bundletool dump manifest --bundle app-release.aab \
  --xpath /manifest/uses-permission/@android:name
```

`bundletool` is a standalone jar published by Google
(`github.com/google/bundletool/releases`). It does not ship with Android Studio.

### Reading an APK (fine for local testing)

```
aapt2 dump permissions app-release.apk
```

**An APK is enough for installing on your own device.**
It just isn't an answer to "what will the store version request."

---

## Watch for permissions that disappear, too

Permissions don't only get added — **they get removed.**

Dropping a library or changing an implementation can quietly remove something heavy like
`QUERY_ALL_PACKAGES`, **which lets you simplify your declaration.**

Play asks you to justify `QUERY_ALL_PACKAGES` during review, so
**if you managed to drop it, it's worth confirming that it's actually gone.**

---

## The procedure

1. **Build a release AAB** (a debug build is a different artefact)
2. **Dump the permissions with `bundletool dump manifest`**
3. **Track down every entry you didn't declare** and identify the library behind it
4. **If `AD_ID` is present, declare use of the advertising ID**
5. **Diff against the list from your last submission**

**Step 3 takes the longest.** Searching the permission name usually identifies the SDK.

---

## Why reading the source doesn't work

The Android build **merges the manifests of every library you depend on.**

You can write nothing in your own `AndroidManifest.xml` and still ship a permission,
because a library declared it.

**`build.gradle.kts` won't show it either** — your direct dependencies pull in their own.

**There is no reliable method other than reading the artefact.**

---

Recorded 2026-08. Android / Flutter / Google Play.