Google OAuth app verification: what the privacy policy must be, and where it must live
By Paul Cranmer, Founder · Last verified October 2026 · Google Cloud console · OAuth consent screen → Branding
OAuth verification is the review Google runs before an app can request sensitive or restricted scopes from everyone. The brand verification part is where privacy policy links fail: Google says the privacy policy should be hosted within the domain that hosts your homepage, should be linked on the homepage so users can find it, must be linked from the OAuth consent screen, and must disclose how your app accesses, uses, stores and shares Google user data; the homepage must be on a verified domain you own, verified through Search Console by a project owner or editor. This page lays out the four checks and the honest answer for apps whose policy is hosted elsewhere.
Who this is for
- Developers whose verification request came back with a privacy policy or homepage finding
- Apps requesting Gmail, Drive, Calendar or other sensitive scopes
- Teams whose policy page lives on a third-party host
Not for
- Apps that only use non-sensitive scopes (no verification review, the consent screen link still matters)
- Internal apps restricted to one Google Workspace organization
What the platform requires
- The privacy policy should be hosted within the domain that hosts your homepage.
- It should be linked on your homepage so users can find it, and it must be linked from the OAuth consent screen in the Google API console.
- It must disclose how your app accesses, uses, stores and shares Google user data.
- The homepage must be hosted on a verified domain you own; the privacy policy link on the homepage should match the one on the consent screen; domain ownership is verified in Search Console by a project owner or editor.
Get a live URL first
Honest answer: for OAuth verification Google wants the policy on your own domain, so a page hosted on privacypolicyurl.com is not what the reviewer expects. Use the wizard (API/SDK, free) to generate the text with the Google user data section, publish it at yourdomain.com/privacy, link it from your homepage and the consent screen, and verify the domain in Search Console. Our hosted URL remains useful for app stores and ad platforms.
Generate the policy text with a Google data section (free)Step-by-step: paste your privacy policy URL
- Generate a policy with a Google user data section. Run the wizard as API/SDK and list the Google scopes (Gmail, Drive, Calendar) and what the app does with that data, how long it keeps it and who else sees it.
- Publish it on your homepage's domain. Put the page at a path on the same domain as your homepage, for example https://yourdomain.com/privacy, and link it from the homepage footer.
- Set the link on the OAuth consent screen. Google Cloud console → APIs & Services → OAuth consent screen (Branding): Application home page, Application privacy policy link, Application terms of service link. Use the exact URL from the homepage.
- Verify the domain in Search Console. Add the domain to Authorized domains and verify ownership in Search Console with an account that is a project owner or editor.
- Submit for verification. Request verification with the scope justification and demo video Google asks for; the brand checks above are the part this page covers.
Field labels to look for
- OAuth consent screen → Branding
- Home page, privacy policy link, terms of service link, authorized domains.
- Search Console
- Domain verification by a project owner or editor.
Common reasons the form fails
- Policy hosted on a different domain than the homepage
- Homepage with no link to the policy
- Policy that never mentions Google user data
- Authorized domain not verified by an owner or editor of the project
No website yet?
If your product has no website of its own, make one page on your domain for the policy before requesting verification; that single page satisfies the homepage-domain rule, and it can embed the same text the wizard produced.
FAQ
Can my OAuth privacy policy be hosted on another domain?
Google says it should be hosted within the domain that hosts your homepage. A policy on another host is a common verification finding; host it on your domain and link it from both the homepage and the consent screen.
What must the policy say about Google data?
How your app accesses, uses, stores and shares Google user data.
Who verifies the domain?
An account listed as a project owner or editor, through Search Console.