用户安全和 SDK 简介
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
作为应用开发者，您需要保护用户并确保应用能够安全稳定地运行，防范任何安全漏洞，包括可能由您所用的软件开发套件 (SDK) 引入的安全漏洞。
作为 SDK 提供方，您肯定不希望自己的 SDK 导致应用/游戏开发者违反 Google Play 开发者政策，进而使他们遭受业务中断并面临 Google Play 采取的违规处置措施。
无论您是使用 SDK 的应用开发者，还是 SDK 提供方，都有必要详细了解一下用户安全最佳实践。
针对应用开发者的说明
对于 SDK 提供方
- 了解 Google Play 开发者政策。
及时知晓 Google Play 政策更新，以确保您的 SDK 不会导致应用违反 Play 政策，例如设备和网络滥用政策、广告政策以及用户数据政策中与永久标识符有关的规定。否则，如有应用使用了您的 SDK，则可能会违反这些政策，并因此受到 Google Play 的违规处置。例如：
- 如果您的 SDK 会使用个人数据和敏感的用户数据，您必须确保已在您公开提供的文档中向使用您 SDK 的应用开发者阐明这一点。
- 如果 SDK 会在运行时加载 JavaScript、Python 或 Lua 等解释型语言（例如未打包到应用软件包中），则不得允许可能违反 Google Play 政策的行为，例如在没有正当理由，或未进行适当披露并征得用户同意的情况下收集已安装的软件包的数据。
- 不出售个人信息以及敏感的用户信息。
在您的 SDK 中支持最新的 API 安全功能和数据最少化功能。如需了解详情，请参阅 2022 年 4 月的博文。
帮助您的客户了解您的 SDK 可能会收集哪些用户数据以及它为何需要使用这些数据，以便应用开发者能够将相关说明添加到向最终用户提供的醒目披露声明和用户意见征求屏幕中，并能在适用的情况下将其添加到各自的隐私权政策中。
您应实现会读取并遵守应用开发者收集的用户偏好设置的逻辑，或者确保提供一种机制来让应用开发者根据这类面向用户的意见征求事件准确初始化您的 SDK。
以一种便于公开访问和浏览的格式提供您的数据使用方式信息。这里是一种可选格式，您或许会有兴趣使用它来发布信息，因为很多开发者都非常熟悉这种格式。如需查看示例，请参阅 Google Firebase SDK 数据披露声明和 Google AdMob SDK 数据披露声明。
本页面上的内容和代码示例受内容许可部分所述许可的限制。Java 和 OpenJDK 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-27。
[null,null,["最后更新时间 (UTC)：2025-07-27。"],[],[],null,["# About user safety and SDKs\n\nAs an **app developer**, you want to make sure that you can keep your users safe\nand your apps secure and stable from any vulnerabilities, including those that\nmay be introduced by Software Development Kits (SDKs) that you use.\n\nAs an **SDK provider**, you don't want to have your SDK cause an app or game\ndeveloper to violate Google Play Developer policies, which can disrupt their\nbusiness and expose them to enforcement actions by Google Play.\n\nLearn more about best practices for user safety, whether you're an app developer\nusing an SDK or an SDK developer.\n\nFor app developers\n------------------\n\n- Before you integrate an SDK into your app, [ensure you\n know](https://medium.com/androiddevelopers/getting-to-know-the-behaviors-of-your-sdk-dependencies-f3dfed07a311) what permissions it uses, what data it collects, and why. Include this information in your [Data safety\n form](https://support.google.com/googleplay/android-developer/answer/10787469). Note that you as the app developer are responsible for the SDK's data collection behavior, even if you don't use a particular function of the SDK.\n- Review all [Google Play Developer policies](https://play.google.com/about/developer-content-policy/) relating to when you can and cannot extend the use of User Data you have collected. For use of device location, for example, you must make any sharing of this data with a third party/SDK known to end users through the [Prominent Disclosure and Consent requirements](https://support.google.com/googleplay/android-developer/answer/11150561).\n- Stay up to date with [Google Play policy\n updates](https://support.google.com/googleplay/android-developer/answer/9934569?ref_topic=9877065) to make sure an SDK you have included in your app does not cause your app to violate Play Policies, such as updates to the [Device and Network Abuse Policy](https://support.google.com/googleplay/android-developer/answer/9888379), [Ads Policy](https://support.google.com/googleplay/android-developer/answer/9857753?ref_topic=9857752), and [User Data Policy with respect to\n Persistent Identifiers](https://support.google.com/googleplay/android-developer/answer/10144311).\n- Do not sell personal and sensitive user information.\n- If you receive an enforcement notice about an SDK-caused violation in your app that you need to address, refer to [our instructions for how to resubmit\n your app following a policy violation](https://support.google.com/googleplay/android-developer/answer/2477981#resubmit).\n- Check out [Google Play SDK Index](https://play.google.com/sdks) to see which SDKs are registered on Google Play Console, which Android permissions those SDKs use, and more.\n\nFor SDK providers\n-----------------\n\n- Understand [Google Play Developer policies](https://play.google.com/about/developer-content-policy/).\n- Keep up to date with Google Play policy\n [updates](https://support.google.com/googleplay/android-developer/answer/9934569?ref_topic=9877065) to make sure your SDK does not cause\n apps to violate Play Policies, such as\n updates to the [Device and Network Abuse Policy](https://support.google.com/googleplay/android-developer/answer/9888379),\n [Ads Policy](https://support.google.com/googleplay/android-developer/answer/9857753?ref_topic=9857752), and [User Data Policy with respect to\n Persistent Identifiers](https://support.google.com/googleplay/android-developer/answer/10144311). Apps that use\n your SDK may be in violation of these policies and therefore may face\n enforcement actions by Google Play. For example:\n\n - If your SDK uses Personal and Sensitive user data, then you must ensure that you have made this clear in your public documentation to apps using your SDK.\n - SDKs with interpreted languages (JavaScript, Python, Lua, etc.) loaded at run time (for example, not packaged with the app) must not allow potential violations (for example, collection of installed packages without appropriate purpose, disclosure and consent) of Google Play policies.\n - Do not sell personal and sensitive user information.\n- Support the [latest API security and data minimization features](/google/play/requirements/target-sdk)\n in your SDKs. See an [April 2022 blog post](https://android-developers.googleblog.com/2022/04/expanding-plays-target-level-api-requirements-to-strengthen-user-security.html) for more\n information.\n\n- Help your customers understand what User Data your SDK may collect and\n the reason for its use, so that app developers can include this in their\n [Prominent Disclosure and Consent](https://support.google.com/googleplay/android-developer/answer/10144311) to\n end users, and in their Privacy Policies when this applies.\n\n- You should implement logic that reads and adheres to the app\n developer-collected user preference, or ensure that a mechanism exists for\n the app developer to accurately initialize your SDK according to this\n user-facing consent event.\n\n- Provide information about your data use in a format easy to access and\n consume publicly. Here is an [optional format](https://support.google.com/googleplay/android-developer/answer/10787469#optional_format_for_SDKs)\n that you may be interested in using to publish your information, as many\n developers are familiar with this format. For examples, see the [Google\n Firebase SDK data disclosure](https://support.google.com/analytics/answer/11582702) and the [Google AdMob\n SDK data disclosure](https://developers.google.com/admob/android/play-data-disclosure)."]]
