自分で宣言していない権限が入るPermissions you never declared

Play のデータセーフティ申告の前に確認すること／ 2026年8月What to check before filing Play's Data safety form — August 2026

記録（Markdown・そのまま使えます）The notes (Markdown, ready to use)

何の話かWhat this is about

データセーフティはアプリが実際に何を集めているかの申告で、実際の動きと食い違うと公開が止まります。

ところが AndroidManifest.xml を読んでも、実際の権限は分かりません。ライブラリが連れてくる権限は1行も書かれていないからです。

Play's Data safety form declares what your app actually collects, and if it disagrees with what the app does, your release is blocked.

But reading AndroidManifest.xml won't tell you the real list — permissions pulled in by libraries appear nowhere in it.

Measurements from five shipping apps. One declaring only INTERNET shipped ten. Even an offline game shipped four
The four an ads SDK pulls in, and exactly where they land on the form
Why you read the AAB and not the APK — a case where the two disagreed by three permissions
The bundletool command that dumps an AAB's permissions

引用・転載・改変　自由Quote, republish, and modify freely HY Studio