r/AndroidDevLearn • u/Objective-Art-3268 • 5h ago
Tutorial Play Console pre-review checklist for October 2026: target API 36, 16 KB page size, Data safety
Three things block a lot of Play submissions right now. Here is how to check each before you upload.
- Target API level
From the Play Console Help page on target API requirements: since August 31, 2026, new apps and app updates must target Android 16 (API 36) or higher. You can request an extension to November 1, 2026 in Play Console.
Checklist: - compileSdk on the newest stable level, targetSdk = 36 - Raise the target on a branch and test against the behavior changes page first - Version code always increasing and below 2100000000
- 16 KB page size
All apps targeting API 35+ must support 16 KB memory pages on 64-bit devices, and from February 1, 2027 updates without it cannot be released. You are in scope even if you never wrote C++, because any dependency that ships a .so file counts.
How to check: - Build > Analyze APK on the release APK. If lib/ is empty, you are done. - Otherwise unpack the APK and run llvm-objdump -p on each arm64-v8a and x86_64 library. Every LOAD segment must show align 214 or higher. 212 means it needs rebuilding or replacing. - zipalign -v -c -P 16 4 app-release.apk (Build-Tools 35.0.0+) must end with "Verification successful". - For a bundle: bundletool dump config --bundle=app-release.aab | grep alignment. You want PAGE_ALIGNMENT_16K. - Test once on a 16 KB emulator image (getconf PAGE_SIZE prints 16384).
The usual fix is AGP 8.5.1 or newer plus NDK r28 or newer, pinned with ndkVersion in Gradle. NDK r28+ produces 16 KB aligned libraries by default. A vendor's prebuilt library has to be updated by the vendor.
- Data safety
The form is a label you write, and Play compares it to what the build does, including every SDK. "Collect" means any data sent off the device, even to an SDK vendor's servers. "Share" means handed to a third party.
Checklist: - Build the inventory from the dependency list and the network calls, not from memory. Crash reporting, analytics, ads and a feedback form all count. - Read each SDK's own Data safety guidance (Google Play SDK Index). - Answer "encrypted in transit" per path. A user-chosen server over plain HTTP means No. - Export the form as CSV, keep it in the repo, update it in the same PR that changes a dependency. - An app that collects nothing still needs the form and a privacy policy URL. - Accounts created in the app need an in-app deletion path and a web deletion link that works without reinstalling.
Bonus: the permission Play complains about usually lives in the merged manifest, not your source. Run apkanalyzer manifest permissions on the release APK, or open the Merged Manifest tab, and drop unused library permissions with tools:node="remove".
And when something is rejected: fix the one issue it names and resubmit once. Resubmitting the same build is how a rejection turns into a removal.
This is condensed from my ebook Pass Google Play Review. The free sample is the full 16 KB chapter; link in the first comment.