From Google’s page on this:

> When Google becomes aware of a discrepancy between your app behavior and your declaration, we may take appropriate action, including enforcement action.

(https://support.google.com/googleplay/android-developer/answ...)

There are at least some checks in place. I was filling it out for an app that I work on, and forgot about a feature where we shared a GPS location with an API to get a street address. I checked the box to say that the users GPS position never leaves the phone and I pretty much instantly got an email saying that the app was rejected and to fill out the form again.

That's good to hear, but how do they tell? I mean, following a GPS API call through to something that talks over the network seems like the kind of thing that would be a decent amount of work even with the source code; am I underestimating the state of modern analysis on binaries?

ah I bet this is google detecting an SDK, not doing deeper code analysis to detect exfiltration of GPS data

they did this with the huq sdk https://www.vice.com/en/article/y3vp35/google-tells-apps-dis...

agree, but also this is where tech needs to get if we want to have private experiences + actual control over downloaded binaries

(could also do dataflow analysis on code in a trusted third party CI system)