Home › Resources

Google OAuth Consent Screen Privacy Policy: What Verification Requires

Published November 1, 2026 · Checked against Google's OAuth App Verification Help Center and API Services User Data Policy on that date

Every public app that asks for Google user data through OAuth must list a privacy policy URL in its OAuth consent screen configuration in the Google Cloud Console. To pass verification, that policy must disclose how your app accesses, uses, stores and shares Google user data, be hosted on the same verified domain as your homepage, be linked from that homepage with the identical URL, and, for sensitive or restricted scopes, show that your use of the data meets Google's Limited Use requirements.

Below: the Google document behind each rule, the findings reviewers send back, and a disclosure block to adapt. Not legal advice.

When Verification Is Required and Which Scopes Trigger It

Google sorts OAuth scopes into three categories, and the Cloud Console labels each scope's category when you add it. The category decides how much review your app gets.

Google's page "When is verification not needed" exempts personal use apps under 100 users (who click through an "unverified app" warning), development or testing projects (same warning and 100-user cap), service-account-only apps, internal Workspace apps, and apps a Workspace admin has marked trusted. Exempt apps must still comply with the User Data Policy.

What the Privacy Policy Must State

Google's quick reference guide "App Privacy Policy" lists the findings reviewers send when a policy falls short. Read as a checklist, your policy must state:

1. What Google user data your app accesses, named by type (for example, Gmail message metadata, Calendar events or Drive files), not "information from your Google account".
2. How your app uses that data, tied to the features users see.
3. With whom you share, transfer or disclose it, including service providers that process it for you.
4. The data protection mechanisms you apply to sensitive data, such as encryption in transit and at rest and access controls.
5. Retention and deletion: how long you keep Google user data and how users can have it deleted.

Two more findings reject a policy for what it permits: using Google user data, or transferring it to third parties, for reasons other than providing or improving your application's functionality. If a general clause allows advertising use or partner sharing, state that it excludes Google user data.

The Google API Services User Data Policy adds that a secondary purpose must be disclosed alongside the primary one, and that before accessing new data types or using data in undisclosed ways you must update the policy and prompt users to consent. And the policy must be clearly your own: "Do not submit a template, example, or sample privacy policy."

Hosting Rules and Why Submissions Fail Them

Google's brand verification requirements set where the policy lives:

• The policy must be hosted within the domain that hosts your homepage, and that domain must be verified in Google Search Console by an account listed as an owner or editor on the Cloud project. Every domain under Authorized domains needs this verification.
• Your homepage must link to the policy, and that link must match the URL entered on the consent screen.
• The homepage must describe what your app does; it cannot be only a login page.
• The policy must be current and load for a reviewer with no account in your app: a public page with no sign-in wall.

The named findings show how submissions fail these rules:

• "The provided privacy policy URL is unresponsive": the page times out, returns an error, or redirects to a sign-in screen.
• "The privacy policy URL you gave us is the same as your homepage URL": the policy needs its own page, such as /privacy.
• "Your privacy policy does not appear to be associated with your application/brand": the policy never names the app, or carries a different name from the consent screen.
• "Your privacy policy is improperly formatted": the policy cannot be read as a normal page, for example a file download or an image of text.

The Cloud Console's warning "Make sure your home page includes a link to your privacy policy" is usually traced, in Stack Overflow and r/googlecloud threads, to a link that renders only after sign-in or a policy on a different domain.

That second cause catches third-party hosted policies. A policy hosted on a generator's domain, including the free hosted URL from our privacy policy generator, works for app store listings but sits outside your verified domain. For Google OAuth, use the generator's Download HTML option and publish the policy on your own site.

The Limited Use Disclosure

Apps granted sensitive or restricted scopes must follow the Limited Use requirements of the User Data Policy. They apply to raw data from those scopes and to anything aggregated, anonymized or derived from it:

• Use the data only to provide or improve user-facing features that are prominent in your app's interface.
• Transfer it only to provide or improve those features with the user's consent, for security purposes, to comply with law, or in a merger, acquisition or sale of assets after explicit prior consent.
• Do not let humans read it unless the user affirmatively agreed for specific data, it is needed for security or legal compliance, or the data is aggregated for internal operations.
• Never transfer or sell it to advertising platforms, data brokers or information resellers, use it to serve ads (including retargeting and interest-based ads), or use it to determine creditworthiness or for lending.

Google also wants an explicit statement that you comply. The Google Workspace user data and developer policy asks for "an affirmative or other similar statement" in your app or on your website, for example a homepage link to a dedicated page or to your privacy policy, and gives this wording: "The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements." For scopes outside Workspace, developers commonly write "Google APIs" in place of "Google Workspace scopes", as in the block below.

The block combines that statement with the five disclosures from the earlier sections. Replace the bracketed items, list only the scopes you request, and delete any line that does not apply.

Google User Data

When you connect your Google Account to [App name], we request
access to the following Google user data:
- [e.g. Read-only access to your Google Calendar events
  (https://www.googleapis.com/auth/calendar.readonly)]
- [Your name, email address and profile picture (openid, email,
  profile)]

How we use it. We use this data only to [show your schedule on
the Planner screen and sync changes you make back to Google
Calendar]. We do not use Google user data for advertising
[, and we do not use it to train generalized AI models].

Sharing. We do not sell Google user data. We share it only with
[cloud hosting provider], which processes it on our behalf to run
[App name], or where required by law. [Name any other recipient
and why.]

Protection. Google user data is encrypted in transit (TLS) and at
rest. Access is limited to [roles] who need it to operate the
service.

Retention and deletion. We keep Google user data for [period /
as long as your account is connected]. You can remove [App name]'s
access at any time at https://myaccount.google.com/permissions and
request deletion of stored data by [emailing privacy@yourapp.com
/ using Settings > Delete account]. We delete it within [N]
days of your request.

Limited Use. [App name]'s use and transfer of information
received from Google APIs will adhere to the Google API Services
User Data Policy, including the Limited Use requirements.

The rest of the policy still needs your other data, cookies and user rights; the full structure of an app privacy policy covers those. If the site also runs Google Ads tags, put the advertising cookie and opt-out wording Google's ad products require in a separate section, since Limited Use forbids using OAuth data for ads. To compare Google's review with Apple, Chrome and Slack, see which developer platforms require a privacy policy URL.

Frequently Asked Questions

This page summarizes Google's policies as of the date above; it is not legal advice. Sources: OAuth App Verification Help Center, Verification requirements, When is verification not needed, Restricted scopes, App Privacy Policy quick reference guide, Google API Services User Data Policy, Google Workspace user data and developer policy.