Dan Nolan says Google sends him the name, location and email address of consumers that buy his app. He discovered data from app buyers while updating his seller account.
Nolan runs a popular app in Australia called the Paul Keating Insult Generator that throws out quips worthy of the former labor prime minister there.
"This is a massive oversight by Google. Under no circumstances should I be able to get the information of the people who are buying my apps unless they opt into it and it’s made crystal clear to them that I’m getting this information," Nolan wrote in a blog post. "This is a massive, massive privacy issue Google. Fix it. Immediately."
A Google spokesman declined to comment. But the issue Nolan raises is not a new one. Unlike with Apple's apps, Google does not act as the merchant in transactions in Google Play, the app itself does. Google spells out that policy in its terms of service.
It tells app developers: "Your Product may only use that information for the limited purposes for which the user has given you permission to do so. If your Product stores personal or sensitive information provided by users, it must do so securely and only for as long as it is needed."
And it tells Google Play users: "In order to access certain services in Google Play, you may be required to provide information about yourself such as your name, address, and billing details."
Still, Google Play users may not be aware that their information is in apps developers' hands, privacy watchdogs say.
And the privacy of mobile device users is getting heightened attention from regulators in the U.S. and overseas. They are responding to growing concern over the handling of consumers' private information on mobile devices. They are pushing for greater transparency of what information is collected by apps.
"This developer is right," said Jeffrey Chester, executive director of the Center for Digital Democracy.
He added: "Apps and their partners are collecting huge amounts of information off users, none of which is being meaningfully disclosed."