# Google Play child-safety audit, 2026-08-26

This note compares the current Google Play Child Safety Standards policy with
the release candidate, the deployed production site, and the Play-delivered
Android build. It records technical evidence only. It does not replace the
operator's legal review or authorize submitting the Play Console declaration.

## Official requirements

Who Need Help is in scope because its Play Console category is Social. The
policy still applies when an app is adults-only. Google requires an in-scope
app to:

1. publish globally accessible standards that prohibit child sexual abuse and
   exploitation;
2. provide a reporting or feedback mechanism that users can reach without
   leaving the app;
3. act on child sexual abuse material after obtaining actual knowledge of it;
4. maintain a process for reporting confirmed CSAM to NCMEC or the relevant
   regional authority as required by applicable law; and
5. name an individual in Play Console who can explain and act on the app's
   child-safety procedures.

Google says the public standards must load, cover CSAE or child safety, and
name the app or developer shown on the store listing. Google accepts an
in-app report flow, support email, or chat channel as the feedback mechanism
provided the user can reach it without leaving the app.

Primary sources:

- [Google Play Child Endangerment policy](https://support.google.com/googleplay/android-developer/answer/9878809?hl=en)
- [Google Play Child Safety Standards guidance](https://support.google.com/googleplay/android-developer/answer/14747720?hl=en)
- [Google Play policy update announced 15 July 2026](https://support.google.com/googleplay/android-developer/answer/17134731?hl=en)

## Observed product evidence

| Requirement | Evidence observed on 2026-08-26 | Result |
| --- | --- | --- |
| Public standards | `https://whoneedhelp.com/child-safety` returned HTTP 200. The page names Who Need Help, explicitly prohibits CSAE and CSAM, describes prohibited conduct, explains reporting, and links to the report form. | Technical requirement present |
| In-app feedback | The footer exposes Child safety and Report content on every application page. On the physical device `72551e60`, the Play-delivered `org.whoneedhelp.mobile` version `0.1.3 (4)` opened Child safety inside `MainActivity`. Tapping Report child-safety content opened the same-origin report form inside the app. | Technical requirement present |
| Report classification | The report form opened with Sexual material involving a minor selected. `ContentRemoval.create_notice/3` assigns an anonymous report in this category the `urgent_review` status. The form does not accept an evidence upload. | Technical requirement present |
| Content and account action | Staff permissions and audited operations can hide reported requests or activities, restrict access, and suspend accounts. The published standard says automated signals can prioritize a case but do not prove it. | Technical controls present |
| Authority reporting process | `docs/trust-safety.md` instructs the responsible operator to report confirmed CSAM to NCMEC or the relevant regional authority when applicable law requires it. The public standard states the same process. | Written process present, legal review still required |
| Child-safety contact | The protected support and legal queues exist, but Play requires the developer to name a real individual who can receive Google's notices, explain the procedures, and take action. Code cannot select or attest for that person. | Operator action required |

No report or support request was submitted during the device check. The app
remained the foreground activity throughout the navigation.

## What remains before self-certification

Do not submit the Play declaration until the operator has done all of the
following:

- selected a real, monitored child-safety contact and entered that person's
  name and contact details in Play Console;
- confirmed that the person can open the urgent legal queue and suspend or
  restrict an account through the staff workspace;
- tested inbound mail from Google Play to the selected address;
- reviewed the reporting authority and mandatory reporting procedure for each
  launch jurisdiction; and
- personally reviewed the declaration wording before submitting the legal
  self-certification.

The software and deployed reporting path are ready for that review. Legal
compliance and the truth of the Play self-certification remain human decisions.