# Google Play Data Safety & Permissions Audit (`reaperoak/google-play-data-safety-privacy-audit`) Actor

Audit any Android app's privacy in one row: what data it collects and shares, security practices, permissions, and a transparent risk score with reasons. Built on Google Play's Data safety labels. Bulk, no login.

- **URL**: https://apify.com/reaperoak/google-play-data-safety-privacy-audit.md
- **Developed by:** [Owais Khan](https://apify.com/reaperoak) (community)
- **Categories:** Business, Developer tools, Marketing
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $17.00 / 1,000 app audits

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Google Play Data Safety & Permissions Audit

Audit any Android app's privacy in **one row**: what data it says it collects and shares, its security practices, every permission it requests, and a **transparent risk score with the reasons behind it**. Built on Google Play's Data safety labels, for bulk audits without opening a single store page.

### What is the Google Play Data Safety & Permissions Audit?

Since 2022 every app on Google Play must publish a Data safety label describing what data it collects, what it shares with third parties and what security practices it follows. This Actor reads those labels and each app's permission list and turns them into an audit you can sort, filter and export. The risk score lists every reason with its points, so you can see exactly why an app rates LOW, MEDIUM or HIGH.

### What makes it different?

- **Transparent scoring.** Every point comes with a plain-English reason, for example: *Shares sensitive data with third parties: Location, Financial info.* If a label cannot be read the result is UNKNOWN, never a guess.
- **Labels and permissions together.** The permission list shows what an app can access, and the label shows what it says it does with data.
- **Bulk and filterable.** Audit hundreds of apps and keep only MEDIUM or HIGH risk.
- **Honest about limits.** It reports what developers declared, not what the app actually does.

### What data can you extract from the Data safety section?

| Field | Example |
|---|---|
| `riskLevel, riskScore, riskReasons` | `MEDIUM`, `6`, each reason with points |
| `dataSharedWithThirdParties` | `Approximate location`, `Device or other IDs`, with purposes |
| `dataCollected` | every collected data item with purpose and whether optional |
| `encryptedInTransit, deletionRequestable` | `true`, `true` |
| `independentSecurityReview, familiesPolicy` | `false`, `false` |
| `permissionCount, sensitivePermissionTypes` | `28`, `Location, Contacts, Microphone` |
| `privacyPolicyUrl, installs, rating` | policy link and basic app facts |

A `SUMMARY` record lists how many apps were audited, which were not found, and how many fall into each risk level.

### How to audit Android app privacy

1. Paste package names or Play Store URLs.
2. Optionally keep only MEDIUM or HIGH risk, and choose whether to include the full permission list.
3. Click **Start**.
4. Download JSON, CSV or Excel, or call the Actor from the API, a schedule, Make, n8n or Zapier.

```json
{
    "apps": [
        "com.spotify.music",
        "org.thoughtcrime.securesms"
    ]
}
```

- **minRisk**: apps below this level are neither returned nor charged.
- **includePermissions**: the counts are always returned; the full list is optional.
- **language / country**: change the wording of labels and permission names.

### How much does an app privacy audit cost?

You pay per app audited returned plus a very small start fee. There is no subscription.

| Apps | Approximate cost |
|---|---|
| 10 | $0.20 |
| 100 | $2 |
| 500 | $10 |
| 1,000 | $20 |

Paid Apify plans get tiered discounts, and you can set a maximum cost per run. You can try it on Apify's free plan without a card.

### Who is it for?

- **Privacy, compliance and security teams** reviewing third-party SDKs and vendor apps.
- **Investors and analysts** doing due diligence on app companies.
- **Journalists and researchers** studying data practices across a category.
- **App publishers** benchmarking their own label against competitors.

### Frequently asked questions

**Is the risk score a legal or security verdict?** No. It is a transparent heuristic over what the developer declared. A LOW score does not prove an app is safe, and a HIGH score does not prove it is abusive.

**Why can the label disagree with the app's real behaviour?** Developers write their own labels. Google reviews them but they can be incomplete or out of date.

**What if an app has no readable Data safety label?** The risk level is UNKNOWN and no score is given. An empty label can mean the developer has not published one or that Google's page could not be read, so guessing would be unfair. UNKNOWN apps are returned only when the minimum risk is Low.

**Are apps that are not found charged?** No. Only apps that are successfully audited are charged.

**What if Google changes the page?** The run fails with an explicit error instead of returning empty audits, and the Actor is health-checked every night.

### Notes and limits

- Reads public Google Play pages through the maintained open-source `google-play-scraper` library. This Actor is not affiliated with Google.
- The scoring rules are fixed and listed in every row, so results are reproducible.

# Actor input Schema

## `apps` (type: `array`):

Google Play package names such as <code>com.whatsapp</code>, or <code>play.google.com</code> app URLs.

## `minRisk` (type: `string`):

Filter the output by risk level. Apps below the level are not returned and not charged. Apps whose label could not be read (UNKNOWN) are returned only at the default setting.

## `includePermissions` (type: `boolean`):

Adds every permission the app requests. The permission counts are always included.

## `language` (type: `string`):

Two-letter language for the labels and permission names.

## `country` (type: `string`):

Two-letter store country used for the app details.

## Actor input object example

```json
{
  "apps": [
    "com.spotify.music",
    "org.thoughtcrime.securesms"
  ],
  "minRisk": "LOW",
  "includePermissions": true,
  "language": "en",
  "country": "us"
}
```

# Actor output Schema

## `results` (type: `string`):

One row per app: risk level, score and reasons, data shared and collected, security practices and permissions.

## `summary` (type: `string`):

How many apps were requested and audited, which were not found, and how many fall in each risk level.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "apps": [
        "com.spotify.music",
        "org.thoughtcrime.securesms"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("reaperoak/google-play-data-safety-privacy-audit").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "apps": [
        "com.spotify.music",
        "org.thoughtcrime.securesms",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("reaperoak/google-play-data-safety-privacy-audit").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "apps": [
    "com.spotify.music",
    "org.thoughtcrime.securesms"
  ]
}' |
apify call reaperoak/google-play-data-safety-privacy-audit --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,reaperoak/google-play-data-safety-privacy-audit"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/CvNcLYFClBXw8zJ3a/builds/87nenqqe8TbEgsBac/openapi.json