Google Play Invalid Privacy Policy: How to Fix It

What this rejection means

Every app on Google Play needs a privacy policy link in Play Console, and apps that handle personal or sensitive data must also link it inside the app. “Invalid” usually means a PDF, a page behind a login, a broken link, or a page that doesn’t name your app or developer.

Why reviewers send it

Google checks that the privacy policy URL works, is a public web page rather than a PDF, names your app or developer, and covers the data the app handles. Apps with sensitive permissions must also link it inside the app.

The message Google Play sends

Issue found: Invalid privacy policy

Your app requests sensitive permissions such as CAMERA, so it must link to a valid privacy policy on both the app’s store listing page in Play Console and within the app.

The exact wording changes from one review to the next; the policy name is what to look for.

How to fix it

Publish the policy on a public web page — not a PDF, not behind a login — that names your app or your developer name on Google Play.
Say what data you collect, how you use and share it, how long you keep it, and how to ask for deletion.
Add the URL in Play Console → Policy → App content → Privacy policy, and link it inside the app.
Resubmit the release.

Fix it with Lovable, Bolt or Cursor

If the app was built with an AI builder, paste this into it, then check the result on a phone:

Add a /privacy page with our privacy policy, and link to it from the settings screen and the sign-up screen.

What to tell Google Play

Replace the [brackets] with what you actually changed:

Our privacy policy is at [URL]. It is public, names [app / developer], and is linked inside the app under [Settings].

Got a different message?

Paste the whole rejection into the rejection explainer. It recognises this one and 26 others, in your browser — nothing is uploaded.

Google Play invalid privacy policy