Google Play Publishing Checklist

Both types have the same features and both can earn money. You must use an organization account for financial products, health apps, VPN apps, and government apps.

!Gotcha: The choice can’t be changed during verification. New personal accounts must also pass a 12-tester, 14-day closed test before production, and a personal account that monetizes shows your full address publicly.

You must be 18+, sign in with a Google Account, and accept the Developer Distribution Agreement. You may be asked for a government ID and a card, both in your legal name.

!Gotcha: Prepaid cards aren’t accepted, and the fee isn’t refunded if your info is judged invalid.

Organization accounts need a D-U-N-S Number from Dun & Bradstreet, plus an organization website and phone. The name on your official documents must match your D&B profile.

!Gotcha: It’s free. Services that charge for it are a known scam pattern. Google says to plan up to 30 days.

The order is: link a Google payments profile, verify your developer email, upload ID, verify your device (personal) or website (organization), then verify your phone. You can’t submit apps until this is done.

!Gotcha: Your documents must exactly match your payments profile. Fix the payments profile first if there’s a name or address mismatch. IDs must be valid, in color, and not photocopies.

Install the Play Console mobile app on a non-rooted Android 10+ phone, scan the QR code from Console Home, sign in as the account owner, and tap Verify. It takes under a minute.

If you charge for the app or sell in-app products, payment-method verification can take up to 5 days and may involve a small deposit or bank documents.

Creating the app in Play Console automatically registers your package name for Android developer verification and links it to your account. If someone else already uses that package name, you’ll be asked to pick another.

New apps have had to publish with the Android App Bundle since August 2021. Only older apps can still ship APKs.

Play App Signing is required for new apps that use AABs. Google keeps the app signing key; you sign uploads with your own upload key, and Google recommends the two be different keys.

!Gotcha: Once an app is published to an open track, its signing key is fixed.

Keep the keystore file and passwords somewhere safe outside your laptop, like a password manager. If you lose the upload key, an admin can request an upload key reset in Play Console with a new key’s PEM certificate.

!Gotcha: Google doesn’t say how long a reset takes, so a lost key can stall your updates. Back it up on day one.

Since 31 August 2026, new apps and updates must target API level 36. An extension to 1 November 2026 can be requested from the Policy status page. Wear OS, TV, and Automotive have lower targets.

!Gotcha: Uploads that target an older API level are blocked from release.

Apps targeting Android 15+ must support 16 KB page sizes on 64-bit devices. Pure Java/Kotlin apps already do. Native (.so) apps need AGP 8.5.1+ and NDK r28+, or the right linker flags.

!Gotcha: Google says updates without 16 KB support can’t be released starting 1 February 2027 (the earlier November 2025 date no longer appears). It doesn’t say whether new apps are blocked today, so ship aligned. Android TV (1 August 2026) and Wear OS (15 September 2026) already require it.

Each upload needs a higher versionCode than the last. The maximum is 2,100,000,000, so don’t jump by huge amounts.

SMS, Call Log, QUERY_ALL_PACKAGES, background location, MANAGE_EXTERNAL_STORAGE, and READ_MEDIA_IMAGES/VIDEO each need a declaration and a core-feature reason. Use the Photo Picker, targeted <queries>, or foreground location instead where you can.

!Gotcha: Libraries can merge permissions into your manifest. Check the merged manifest, not just your own file.

Put the link in Play Console and in the app. The policy has to be on an active URL, labelled as a privacy policy, and cover who you are, what data you collect or share and with whom, security, and retention and deletion.

!Gotcha: Apps that collect no personal data still need one. Missing or non-matching policies are a common rejection.

If anything is behind a login, membership, or location check, provide credentials and instructions. You can add up to 5 sets of instructions, plus notes for one-time codes or multi-factor logins.

!Gotcha: Outdated or OTP-only logins that reviewers can’t get past are an instant rejection.

Include ads from third-party SDKs. House ads for your own apps count; a plain “More apps” menu doesn’t.

!Gotcha: Misrepresenting ads can get your app suspended.

Required for new apps and for updates that change your answers. The questionnaire produces ratings for ESRB, PEGI, USK, and other regional authorities.

!Gotcha: Unrated apps aren’t allowed on Google Play.

Do App access, Ads, and Privacy policy first, since they’re prerequisites. Pick age groups honestly. Any group that includes children brings in the Families policy, including using only Families Self-Certified ad SDKs.

!Gotcha: Kid-style marketing on an app not meant for kids can get it rejected. Some categories get extended reviews of 7+ days.

Required for every app on a closed, open, or production track (internal-only apps are exempt), even if you collect nothing. Declare what your SDKs collect too, and keep it consistent with your privacy policy.

!Gotcha: Google doesn’t check accuracy up front, but if they find a mismatch later they can block updates or remove the app.

Provide a prominent in-app path to delete the account and its data, plus a web page where people can request deletion without reinstalling. Enter that URL in the Data safety form.

!Gotcha: Deactivating or freezing the account doesn’t count as deletion.

Apps targeting Android 13+ must declare com.google.android.gms.permission.AD_ID in the manifest to read the advertising ID. Ad SDKs usually merge it in for you. Use App Set ID for analytics instead.

Every published app must complete both, including apps on closed and open tracks. If you have none, choose the “doesn’t provide” option. It takes a minute.

!Gotcha: Skipping these leaves “Needs attention” items that block your release.

Government apps may need written authorization. News and magazine apps must self-declare. Any app with COVID-19 contact tracing or status features must say so.

Keep it plain and accurate. Add a contact email (required); a website and phone are optional but recommended.

!Gotcha: No emojis, ALL CAPS, “#1” or “best” claims, prices or promos, unattributed testimonials, or repeated keywords. These are the most common metadata rejections.

32-bit PNG with alpha, 512 × 512 px, up to 1024 KB.

!Gotcha: No badges or text that imply ranking, price, or category.

JPEG or 24-bit PNG with no transparency, at exactly 1024 × 500 px. It’s required.

JPEG or 24-bit PNG, no alpha, each side 320–3840 px, and the long side no more than twice the short side. To be eligible for featuring, use at least 4 screenshots at 1080 × 1920 (9:16) or larger.

!Gotcha: Raw captures from most current phones (1080 × 2400, 1080 × 2424) and iPhone screenshots like 1179 × 2556 are taller than 2:1, so Play Console rejects them. Fit them into a 9:16 canvas instead of uploading them as they are.

Large-screen screenshots are 1080–7680 px, 16:9 landscape or 9:16 portrait, with at least 4 for large-screen featuring. They’re recommended if your app works well on tablets.

One public or unlisted YouTube video URL (not a playlist), embeddable, with ads turned off and no age restriction. Only the first 30 seconds autoplay.

Google’s rule covers personal developer accounts created after 13 November 2023. Its help page scopes the rule to personal accounts only, so organization accounts appear to be exempt.

!Gotcha: The rule also applies before you can use pre-registration.

Internal testing can begin before your setup is complete and reaches testers within minutes. It’s the fastest way to catch crashes before the clock starts.

!Gotcha: Even the first internal release goes through review, so budget time before day 1.

Add testers with an email list or a Google Group (name@googlegroups.com). Testers need a Google account. The opt-in link only appears once the release status is “Published”, which can take several hours.

Each tester must be on your list and actively opt in through the link. Friends, family, coworkers, and tester-swap communities are the usual sources. Recruiting a few more than 12 means one dropout won’t sink you.

!Gotcha: Paid “12 testers” services exist, but testers who never use the app make the production-access questions hard to answer honestly.

Testers must stay opted in continuously. Someone who tests for fewer than 14 days and opts out doesn’t count.

!Gotcha: If a tester opts out and back in, their 14 days have to be consecutive, so their clock effectively restarts.

The production application asks how you collected feedback, what testers said, and what you changed because of it. Push an update to the closed track during the test so you have a real answer.

Answer questions about your closed test (recruiting, feature coverage, feedback), your app (audience, value, expected first-year installs), and readiness (what you changed, how you know it’s ready). Write specific, concrete answers.

!Gotcha: Google doesn’t publish denial reasons. Developers commonly report short, vague answers as the cause. If you’re denied, you may need to keep the closed test running.

Pick your countries, add the AAB and release notes, and send the changes for review. Reviews take a few hours to 7 days, sometimes longer, and new developer accounts may see extended review times.

!Gotcha: Changing and resubmitting while in review restarts your place in the queue. Plan at least a week of buffer.

Roll updates out to a percentage of users you choose. It never increases on its own, and you can halt it if crashes spike. Staged rollouts aren’t available for the first publish.

Managed publishing holds approved changes until you click “Publish changes”, so you control the exact launch time.

!Gotcha: You can’t use managed publishing when publishing an app for the first time.

Google’s current bad-behavior thresholds are a 1.09% user-perceived crash rate and a 0.47% overall ANR rate. Check Android vitals in Play Console for where you stand.

“App rejected” means a first publish failed; “Update rejected” means an update did. Fix the issue and resubmit, or appeal if you think it’s wrong. A removed app needs a compliant update; a suspended app needs a successful appeal.

Remove ranking or price claims, emojis, ALL CAPS, keyword repetition, and testimonials. Make sure screenshots show the actual app.

Apps that crash, don’t load, or only show static content are rejected. So are webview wrappers of a website you don’t own. Test on real devices and check the pre-launch report.

Audit every SDK in your build and make your Data safety answers, privacy policy, and manifest all say the same thing.

Swap in the Photo Picker, Contact Picker, SMS Retriever API, or targeted package visibility where you can. If the permission is truly core, fill in the Permissions declaration form.

Don’t use names, logos, or icons that look like another brand, and don’t call the app “official” without the rights. If you use third-party IP with permission, send that permission to Google Play in advance.