關於使用者安全性和 SDK
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
身為應用程式開發人員，您不僅需要保護使用者安全，也需確保應用程式的運作安全穩定，沒有任何安全漏洞，包括可能經由軟體開發套件 (SDK) 帶來的安全漏洞。
身為 SDK 供應商，您肯定不會希望自己的 SDK 造成應用程式或遊戲開發人員違反 Google Play 開發人員政策規定，因為這可能會導致他們的業務中斷，並讓他們受到 Google Play 的違規處置。
無論您是使用 SDK 的應用程式開發人員，還是 SDK 開發人員，都可以進一步瞭解保障使用者安全的最佳做法。
應用程式開發人員專區
- 在將 SDK 整合至應用程式前，請確實瞭解 SDK 使用的權限、收集的資料類型，以及蒐集原因。請在資料安全性表單中附上這些資訊。請注意，身為應用程式開發人員，您必須對所用 SDK 的資料收集行為負責，即使您並未使用該 SDK 的特定功能亦然。
- 請詳閱所有 Google Play 開發人員政策，瞭解何時可以和不可以擴大使用所收集的使用者資料。舉例來說，如果您要使用裝置位置，就必須透過醒目揭露事項和同意聲明規定，向使用者說明會將這類資料分享給第三方/SDK。
- 請及時瞭解 Google Play 政策更新內容，確保您在應用程式中使用的 SDK 不會造成應用程式違反 Play 政策，例如「裝置與網路濫用行為」政策、「廣告」政策，以及「使用者資料」政策中的永久 ID 相關規定。
- 請勿販售使用者的個人和機密資訊。
- 如果您收到違規處置通知，指出您必須處理 SDK 在應用程式中造成的違規問題，請參閱這篇文章，瞭解如何在發現違反政策問題後重新提交應用程式。
- 請參閱 Google Play SDK 索引，瞭解 Google Play 管理中心已註冊哪些 SDK、這些 SDK 使用的 Android 權限，以及其他資訊。
適用於 SDK 供應商
- 瞭解 Google Play 開發人員政策。
請及時瞭解 Google Play 政策更新內容，確保您的 SDK 不會造成應用程式違反 Play 政策，例如裝置與網路濫用行為政策、廣告政策，以及使用者資料政策中的永久 ID 相關規定。如果應用程式使用您的 SDK，就可能違反這些政策，並因此受到 Google Play 的違規處置。例如：
- 如果您的 SDK 會使用使用者的個人和私密資料，您就必須在公開文件中明確向使用該 SDK 的應用程式說明這一點。
- 如果 SDK 會在執行階段載入 JavaScript、Python、Lua 等解譯語言，就不得允許可能違反 Google Play 政策規定的行為，例如在沒有正當理由，或未進行適當揭露並徵求使用者同意的情況下，收集已安裝套件的資訊。
- 請勿販售使用者的個人和機密資訊。
讓您的 SDK 支援最新的 API 安全性和資料最小化功能。詳情請參閱2022 年 4 月的網誌文章。
協助客戶瞭解您的 SDK 可能會收集哪些使用者資料，以及為何需要使用這些資料，以便應用程式開發人員將這些資訊加入對使用者顯示的醒目揭露事項和同意聲明中，並視情況將這些資訊加入自身的隱私權政策。
您應該實作一種能讀取應用程式開發人員收集的使用者偏好，並遵循這些偏好的邏輯；或是確保應用程式開發人員可以透過適當機制，根據這類向使用者徵詢同意的事件，將您的 SDK 初始化。
採用方便公眾存取及瀏覽的格式來介紹您的資料用途。以下是您可能想用來發布資訊的選用格式，許多開發人員都熟悉這類格式。如需範例，請參閱 Google Firebase SDK 資料揭露事項和 Google AdMob SDK 資料揭露事項。
這個頁面中的內容和程式碼範例均受《內容授權》中的授權所規範。Java 與 OpenJDK 是 Oracle 和/或其關係企業的商標或註冊商標。
上次更新時間：2025-07-27 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-27 (世界標準時間)。"],[],[],null,["# About user safety and SDKs\n\nAs an **app developer**, you want to make sure that you can keep your users safe\nand your apps secure and stable from any vulnerabilities, including those that\nmay be introduced by Software Development Kits (SDKs) that you use.\n\nAs an **SDK provider**, you don't want to have your SDK cause an app or game\ndeveloper to violate Google Play Developer policies, which can disrupt their\nbusiness and expose them to enforcement actions by Google Play.\n\nLearn more about best practices for user safety, whether you're an app developer\nusing an SDK or an SDK developer.\n\nFor app developers\n------------------\n\n- Before you integrate an SDK into your app, [ensure you\n know](https://medium.com/androiddevelopers/getting-to-know-the-behaviors-of-your-sdk-dependencies-f3dfed07a311) what permissions it uses, what data it collects, and why. Include this information in your [Data safety\n form](https://support.google.com/googleplay/android-developer/answer/10787469). Note that you as the app developer are responsible for the SDK's data collection behavior, even if you don't use a particular function of the SDK.\n- Review all [Google Play Developer policies](https://play.google.com/about/developer-content-policy/) relating to when you can and cannot extend the use of User Data you have collected. For use of device location, for example, you must make any sharing of this data with a third party/SDK known to end users through the [Prominent Disclosure and Consent requirements](https://support.google.com/googleplay/android-developer/answer/11150561).\n- Stay up to date with [Google Play policy\n updates](https://support.google.com/googleplay/android-developer/answer/9934569?ref_topic=9877065) to make sure an SDK you have included in your app does not cause your app to violate Play Policies, such as updates to the [Device and Network Abuse Policy](https://support.google.com/googleplay/android-developer/answer/9888379), [Ads Policy](https://support.google.com/googleplay/android-developer/answer/9857753?ref_topic=9857752), and [User Data Policy with respect to\n Persistent Identifiers](https://support.google.com/googleplay/android-developer/answer/10144311).\n- Do not sell personal and sensitive user information.\n- If you receive an enforcement notice about an SDK-caused violation in your app that you need to address, refer to [our instructions for how to resubmit\n your app following a policy violation](https://support.google.com/googleplay/android-developer/answer/2477981#resubmit).\n- Check out [Google Play SDK Index](https://play.google.com/sdks) to see which SDKs are registered on Google Play Console, which Android permissions those SDKs use, and more.\n\nFor SDK providers\n-----------------\n\n- Understand [Google Play Developer policies](https://play.google.com/about/developer-content-policy/).\n- Keep up to date with Google Play policy\n [updates](https://support.google.com/googleplay/android-developer/answer/9934569?ref_topic=9877065) to make sure your SDK does not cause\n apps to violate Play Policies, such as\n updates to the [Device and Network Abuse Policy](https://support.google.com/googleplay/android-developer/answer/9888379),\n [Ads Policy](https://support.google.com/googleplay/android-developer/answer/9857753?ref_topic=9857752), and [User Data Policy with respect to\n Persistent Identifiers](https://support.google.com/googleplay/android-developer/answer/10144311). Apps that use\n your SDK may be in violation of these policies and therefore may face\n enforcement actions by Google Play. For example:\n\n - If your SDK uses Personal and Sensitive user data, then you must ensure that you have made this clear in your public documentation to apps using your SDK.\n - SDKs with interpreted languages (JavaScript, Python, Lua, etc.) loaded at run time (for example, not packaged with the app) must not allow potential violations (for example, collection of installed packages without appropriate purpose, disclosure and consent) of Google Play policies.\n - Do not sell personal and sensitive user information.\n- Support the [latest API security and data minimization features](/google/play/requirements/target-sdk)\n in your SDKs. See an [April 2022 blog post](https://android-developers.googleblog.com/2022/04/expanding-plays-target-level-api-requirements-to-strengthen-user-security.html) for more\n information.\n\n- Help your customers understand what User Data your SDK may collect and\n the reason for its use, so that app developers can include this in their\n [Prominent Disclosure and Consent](https://support.google.com/googleplay/android-developer/answer/10144311) to\n end users, and in their Privacy Policies when this applies.\n\n- You should implement logic that reads and adheres to the app\n developer-collected user preference, or ensure that a mechanism exists for\n the app developer to accurately initialize your SDK according to this\n user-facing consent event.\n\n- Provide information about your data use in a format easy to access and\n consume publicly. Here is an [optional format](https://support.google.com/googleplay/android-developer/answer/10787469#optional_format_for_SDKs)\n that you may be interested in using to publish your information, as many\n developers are familiar with this format. For examples, see the [Google\n Firebase SDK data disclosure](https://support.google.com/analytics/answer/11582702) and the [Google AdMob\n SDK data disclosure](https://developers.google.com/admob/android/play-data-disclosure)."]]
