Firebase App Privacy Policy: Exact Clauses, GDPR, CCPA & ATT Compliance (2026)

Firebase is the most widely used mobile backend and analytics platform for indie developers. It is also the most common source of privacy policy rejections that developers do not understand — because they wrote a generic privacy policy without realizing that Firebase adds specific data collection obligations they must disclose.

This guide covers exactly what each Firebase SDK collects, the precise privacy policy clauses you need to add when using Firebase, how GDPR and CCPA apply to Firebase data, how to handle Apple's App Tracking Transparency in relation to Firebase, and how to declare Firebase in both Google Play's Data Safety section and Apple's App Privacy labels.

At the end, we will show you how to generate a complete, Firebase-specific privacy policy for free.

Why Firebase Requires Specific Privacy Disclosures

When you integrate Firebase into your app, Google's servers collect data from your users — even if your own app code does not explicitly log any events. Firebase Analytics automatically collects a set of default events and user properties the moment the SDK initializes. Crashlytics automatically sends crash reports including device information. Firebase Performance Monitoring automatically tracks network request timings.

Your privacy policy must disclose all data collection that happens as a result of your app, including collection by third-party SDKs you integrate. A policy that only describes what your own code does, without mentioning Firebase, is incomplete and is the primary reason Firebase apps get flagged during App Review or Play Store policy reviews.

The specific guideline from Apple is Guideline 5.1.1(v): apps must "not collect, use, or share user data with a third party without user consent." Using Firebase without disclosing it in your privacy policy and (for certain data types) obtaining consent is a violation of this guideline. Google Play's User Data Policy has equivalent requirements.

What Each Firebase SDK Collects by Default

Firebase is a suite of products. The data each one collects is different. Here is what the most commonly used SDKs collect automatically, without any developer configuration:

Exact Privacy Policy Clauses for Firebase Apps

Your privacy policy needs specific clauses covering Firebase. Here are the sections to include, with sample language you can adapt:

Firebase + GDPR: EU User Compliance

If your app is available in the European Union, GDPR applies to your Firebase data collection. Here is what you must do:

• Sign Google's Data Processing Amendment (DPA). Go to your Firebase console → Settings → Usage and billing → Manage Data Processing settings. Google's DPA is required for GDPR-compliant processing with Firebase. It is presented as a click-through agreement.
• Obtain consent before initializing Firebase Analytics for EU users. Firebase Analytics is not "strictly necessary" for app function, so under GDPR you need a legal basis (typically consent) for collecting analytics data from EU users. Implement a consent screen before enabling Analytics, or use a Consent Management Platform (CMP). Firebase Analytics SDK can be initialized with analytics collection disabled by default — only enable it after consent is obtained.
• Configure Firebase data retention. In Firebase Console → Settings → Project settings → Google Analytics → Data retention, set the retention period. Under GDPR, you should not retain data longer than necessary. 2–14 months is typical for analytics data.
• Honor data deletion requests. Firebase provides APIs for deleting user data. When a user requests deletion of their data under GDPR Article 17 (right to erasure), you must be able to delete their Firebase data, including their Firebase Authentication account and any data in Firestore/Realtime Database associated with their UID.
• Disclose data transfers to the US. Google's servers are primarily in the US. Your privacy policy should note that data may be transferred to and processed in the United States under Google's Standard Contractual Clauses.

Firebase + CCPA: California User Compliance

The California Consumer Privacy Act (CCPA) applies if your app serves California residents and meets certain thresholds (annual revenue over $25M, OR processes data for 100,000+ California consumers, OR derives 50%+ revenue from selling personal data). Most indie apps do not meet these thresholds, but if yours does:

• Your privacy policy must include a "Do Not Sell My Personal Information" section, even if Firebase Analytics data is not sold. Google processes Firebase data as a service provider, not as a sale — but you must disclose this distinction.
• Firebase Analytics data linked to an advertising ID may be considered a "sale" under CCPA's broad definition. If in doubt, consult a legal professional.
• You must respond to CCPA data access and deletion requests within 45 days.

Firebase + Apple's App Tracking Transparency

App Tracking Transparency (ATT) governs whether your app can access the IDFA (Identifier for Advertisers) on iOS devices. Firebase Analytics uses the IDFA for cross-app attribution if you allow it.

The key decision: does your app use Firebase Analytics for cross-app tracking, or only for measuring your own app's performance?

Firebase in Google Play's Data Safety Section

Google Play's Data Safety section requires you to declare every type of data your app collects or shares, including data collected by Firebase SDKs. Here is how to map Firebase data to Data Safety declarations:

For each declared data type, select "This data is shared with third parties" and enter "Google LLC" as the third party. Failure to accurately complete the Data Safety section is one of the most common causes of Play Store policy violations in 2026.

Firebase in Apple's App Privacy Labels

Apple's App Privacy Labels in App Store Connect require you to declare data collected by all SDKs in your app. For Firebase, you must declare:

• Analytics (Firebase Analytics): Usage Data → App Interactions, Device IDs. Purpose: Analytics. Not linked to identity (unless you explicitly link Firebase Analytics to user identity).
• Crash Data (Crashlytics): Diagnostics → Crash Data. Purpose: App Functionality. Not linked to identity.
• Contact Info (Firebase Auth - Email): Contact Info → Email Address. Purpose: App Functionality. Linked to user identity.
• Identifiers (FCM registration token): Identifiers → Device ID. Purpose: App Functionality. Not linked to identity.

Note that in 2024, Apple added a Privacy Manifest requirement for SDKs that access "required reason" APIs. Firebase SDKs include their own Privacy Manifests in the package. You should verify in Xcode that Firebase's privacy manifests are being merged into your app's final PrivacyInfo.xcprivacy file when you archive for submission.

How to Generate a Firebase-Compliant Privacy Policy Free

WhixFrame's free privacy policy generator covers all Firebase disclosure requirements. Here is what it handles automatically:

• Third-party SDK disclosure section with Firebase named explicitly
• Analytics data collection clause covering Firebase Analytics data types
• Crash reporting clause covering Crashlytics
• GDPR section for EU users (consent, data retention, deletion rights, DPA reference)
• CCPA section for California users (if applicable to your app)
• App Tracking Transparency clause for iOS apps using Firebase Analytics
• Google Play Data Safety mapping guidance
• Privacy policy hosting instructions (free options: GitHub Pages, Notion)

Go to whixframe.com/tools/privacy-policy-generator, enter your app name, developer name, and contact email, select "Firebase Analytics" and other Firebase products you use, select your compliance regions (GDPR for EU, CCPA for California), and download your policy as a text or HTML file. No account required.

Frequently Asked Questions