Google API Services User Data Policy
Stay organized with collections
Save and categorize content based on your preferences.
Last updated February 15, 2024
Google API Services, including Google Sign-In, are part of an authentication and
authorization framework that gives you, the developer, the ability to connect
directly with Google users when you would like to request access to Google user
data. The policy below, as well as the Google APIs Terms of Service,
govern the use of Google API Services when you request access to Google user
data. Please check back from time to time as these policies are occasionally
updated.
Accurately represent your identity and intent
If you wish to access Google user data you must provide Google users and Google
with clear and accurate information regarding your use of Google API Services.
This includes, without limitation, requirements to accurately represent:
-
Who is requesting Google user data? All permission requests must
accurately represent the identity of the application that seeks access to user
data. If you have obtained authorized client credentials to access Google API
Services, keep these credentials confidential.
-
What data are you requesting? You must provide clear and accurate
information explaining the types of data being requested. In addition, if you
plan to access or use a type of user data that was not originally disclosed in
your privacy policy (or in-product disclosures) when a Google user initially
authorized access, you must update your privacy policy and prompt the user to
consent to any changes before you may access that data.
-
Why are you requesting Google user data? Be honest and transparent with
users when you explain the purpose for which your application requests user
data. If your application requests data for one reason but the data will also
be utilized for a secondary purpose, you must notify Google users of both use
cases. As a general matter, users should be able to readily understand the
value of providing the data that your application requests, as well as the
consequences of sharing that data with your application.
Be transparent about the data you access with clear and prominent privacy disclosures
You must publish a privacy policy that fully documents how your application
interacts with user data. You must list the privacy policy URL in your OAuth
client configuration when your application is made available to the public.
Your Privacy Policy and all in-product privacy notifications should be
accurate, comprehensive, and easily accessible. Your privacy policy and
in-product privacy notifications must thoroughly disclose the manner in which
your application accesses, uses, stores, or shares Google user data. Your use of
Google user data must be limited to the practices explicitly disclosed in your
published privacy policy, but you should consider the use of additional in-
product notifications to ensure that users understand how your application will
handle user data. If you change the way your application uses Google user data,
you must notify users and prompt them to consent to an updated privacy policy
before you make use of Google user data in a new way or for a different purpose
than originally disclosed.
Disclosures about data use should be prominent and timely. Your
privacy policy and any in-product notifications regarding data use should be
prominently displayed in your application interface so that users can find this