Does Your Flutter App Need Account Deletion for Google Play? Requirements and a 6-Step Firebase Setup (2026)

By giosaia (GSPTeck) · Published 2026-11-12 · Last verified 2026-11-12

Does my Flutter app need an account deletion option for Google Play?

Yes, if users can create an account in your app. Google Play's User Data policy says an app that allows account creation must also let users request deletion of that account, and Play Console Help spells out two parts: an in-app path to delete the account and its data, and a web link where users can request the same thing without reinstalling the app. Every developer also has to answer the Data deletion questions in the Data safety form. This guide maps those rules onto a Flutter and Firebase app, and was checked against Google Play and Firebase documentation on 2026-11-12.

GSPTeck is giosaia's indie studio building mobile and web apps with Flutter and Firebase. We run one shared web deletion page for our apps, so the examples below come from a setup that is live today.

Grid of Google Play account deletion rules: Data safety deletion questions for every app, an in-app path and a web link for apps with accounts, social sign-in counts, retention must be disclosed, offline and enterprise apps exempt — Google Play's account deletion rules at a glance.

What exactly does Google Play require?

Three things, all listed in Google's account deletion requirements article in Play Console Help: Data deletion answers in the Data safety form for every app, plus an in-app deletion path and a working web link for any app that lets users create an account.

Requirement	Who needs it	Where it lives
Data deletion questions answered	All developers	Play Console, App content, Data safety form
In-app path to delete the account and its data	Apps that allow account creation	Inside the app, for example account settings
Web link to request deletion	Apps that allow account creation	A public URL entered in the Data safety form
Clear note on any data you keep	Apps that retain some data	Your privacy policy

Google also says the requirement applies even if most of the app works without an account: "If your app offers account creation in any part of the app experience", deletion must be offered. Accounts that are created and operated offline are not app accounts, and permanently private and enterprise device management apps are exempt.

Does "Sign in with Google" or anonymous auth count as account creation?

Usually yes for Google Sign-In, Apple Sign-In and email sign-up, because Google defines account creation as a user completing an account flow "directly in the app" or being sent to an account creation flow outside it. Firebase Authentication creates a user record with a UID the moment a user signs in with any provider, and that record is the account you must be able to delete.

Anonymous auth is less clear-cut. Firebase creates a user record for it too, but the user never chose to make an account. If you later let anonymous users link an email or Google account, you are back in scope. Our rule of thumb: if your app stores anything under a UID that a person could recognise as "their" data, offer deletion.

How do I delete a Firebase user from a Flutter app?

Call delete() on the signed-in user, and catch the requires-recent-login error. Firebase's Flutter guide to managing users shows await user?.delete(); and explains that deleting an account is a security-sensitive action that needs a recent sign-in; if the sign-in is too old, the call fails with requires-recent-login and you must re-authenticate the user, then try again.

Put the button where Google expects it. Play's guidance says the in-app path "should be prominent (for example, within the account settings or a similar section)".
Explain what will be deleted and what you must keep, in one short dialog, before the final tap.
Delete the user's data, then the Auth user, or delete the Auth user and let a backend trigger clean up (next section).
Handle requires-recent-login by asking the user to sign in again and calling reauthenticateWithCredential.
Sign out and clear local storage such as cached files and shared preferences, then return to the start screen.

Two columns showing that Firebase user.delete() removes only the Auth user record and needs a recent sign-in, while Firestore documents, Storage files, Realtime Database entries and data at other providers remain — What user.delete() removes, and what it leaves.

Does deleting the Auth user delete their Firestore and Storage data?

No. Deleting a Firebase Authentication user removes the sign-in record only; documents in Cloud Firestore, files in Cloud Storage and entries in Realtime Database stay where they are until you delete them. Google Play's policy says that when you delete an account you "must also delete the user data associated with that app account", and if you use service providers, you should also ask them to delete it.

Firebase gives you two documented routes. The Delete User Data extension deletes data keyed on a user ID from Firestore, Realtime Database or Cloud Storage when the user is deleted from Authentication; it only deletes what you configure, and installing an extension requires the Blaze (pay as you go) plan. Firebase's clear and export end-user data guide describes a clearData function triggered by the same Auth delete event, if you prefer to own the code.

Data	Removed by user.delete()?	What to do
Auth user record	Yes	Re-authenticate first if needed
Firestore documents under the UID	No	Extension, clearData function or your own Cloud Function
Cloud Storage files under the UID	No	Same, with a path that includes the UID
Data held by other providers	No	Delete it and ask the provider to delete it too

Structure makes this easy or painful. If every user document lives under a path that contains the UID, one configured path deletes it. If user data is scattered across shared collections, list each one before you ship. Our Firestore security rules review routine is a good moment to check that every per-user path is keyed on the UID, and remember that point-in-time recovery and scheduled Firestore exports keep copies for their retention window, which belongs in your privacy policy.

What should the web deletion page contain?

Google lists four tests for the web link: it must load without error, make the deletion request path "prominently featured and easily discoverable", reference the app or developer name as it appears on Google Play, and actually let the user request deletion. A link that opens a deletion request, a support email address or a form all qualify. If the user must do something first, such as cancel a subscription, the page has to say so.

A worked example: GSPTeck's delete account and personal data page covers several of our apps on one URL. The user picks the product from a list, enters the email and an optional user ID, confirms they understand deletion is permanent, and the form opens a pre-filled email to our support address so we can verify and process the request. It states what we may retain and links the privacy policy. One shared page is allowed as long as each app's name appears on it the way it appears on Google Play.

Why a web page if the app already has a button? Google's answer: some users "may have already uninstalled your app", so the web resource must work without sending them back to reinstall it.

Four tests for the account deletion web page from Play Console Help: it loads without errors, the request path is prominent, it names the app or developer as on Google Play, and the user can actually request deletion — The four tests for the web deletion page.

How do I fill in the Data deletion section in Play Console?

Open Play Console, go to App content, then the Data safety form, and answer the Data deletion questions. If your app is in scope, Google says you must disclose that the app provides account deletion and enter the web link. Some of these answers appear in the Data safety section of your store listing, so they need to match what your app and web page actually do.

Keep the form consistent with the SDKs you ship. Our Data safety refresh routine for Flutter SDK updates covers the collection and sharing answers, and the post-launch privacy ops checklist covers keeping the privacy and deletion URLs live. Add "deletion URL loads" to your Flutter Firebase release checklist so a site change never breaks it silently.

A 6-step account deletion checklist for Flutter apps

Decide if you are in scope: any account creation, including social sign-in, means yes.
Map every place user data lives: Firestore paths, Storage folders, Realtime Database, third-party services.
Add the in-app button in account settings, with re-authentication handling.
Automate backend clean-up with the Delete User Data extension or a clearData-style function.
Publish the web request page with the app name as listed on Google Play and a working request path.
Answer the Data deletion questions in the Data safety form and state any retention in the privacy policy.

Users see the other side of this. CoinX's guide on deleting a crypto app account and its data walks through the same request from the user's seat, using two of our apps as examples. More of our Flutter and Firebase guides and the apps they come from are on the GSPTeck homepage.

Vertical Pinterest graphic with five steps for Google Play account deletion in a Flutter app — Pinterest pin: account deletion for Flutter apps.

FAQ

Is account deletion required if my app works without an account?

Yes, if account creation is offered anywhere in the app. Google says the requirement still applies "even if some features can be accessed without an account". Apps with no account creation at all only need to answer the Data deletion questions in the Data safety form.

Can I just tell users to email me to delete their account?

For the web resource, yes: Google accepts a customer service email or a form as the request path. Inside the app you still need a path to deletion, which can be a link to that web resource if full in-app deletion isn't feasible yet.

Why does user.delete() fail with requires-recent-login?

Deleting an account is a security-sensitive action in Firebase Authentication, so it needs a recent sign-in. Ask the user to sign in again, call reauthenticateWithCredential, then call delete() again.

Can I keep some data after deleting an account?

Yes, for legitimate reasons such as security, fraud prevention or regulatory compliance. Google says you must clearly inform users about that retention, for example in your privacy policy.

Sources

Play Console Help: Understanding Google Play's app account deletion requirements (checked 2026-11-12)
Firebase docs: Manage users in Firebase (Flutter), delete and re-authenticate (checked 2026-11-12)
Firebase Extensions Hub: Delete User Data (checked 2026-11-12)
Firebase: Clear and export end-user data (checked 2026-11-12)