What it means
All apps that use the VpnService must complete the declaration form to avoid violating the policy resulting in potential enforcement actions.
Understanding Google Play's VpnService policy
Google Play treats BIND_VPN_SERVICE as access to sensitive data or capabilities. An app that requests it must qualify for an allowed use and say so in a declaration in Play Console; Google can reject an update, or remove the app, when the use is not declared or not allowed. It is allowed when VPN is the app's core functionality, or the app needs a remote server for its core feature in one of the cases Google lists: parental control or enterprise management, app usage tracking, device security (anti-virus, device management, firewall), network tools such as remote access, web browsing, carrier connectivity; Google also requires the tunnel to be encrypted, the use documented in the store listing and, when personal data is accessed, a prominent disclosure with consent.
Rejections for this policy arrive as Play Console policy messages whose wording varies, so this page quotes the policy itself rather than one message.
Deadline
No upcoming date is recorded by the store check: the policy is in force, and the declaration is checked at review.
How to fix it
1. Check whether your app qualifies
The permission is allowed when VPN is the app's core functionality, or the app needs a remote server for its core feature in one of the cases Google lists: parental control or enterprise management, app usage tracking, device security (anti-virus, device management, firewall), network tools such as remote access, web browsing, carrier connectivity; Google also requires the tunnel to be encrypted, the use documented in the store listing and, when personal data is accessed, a prominent disclosure with consent. If that is not your app's core feature, do not declare it: remove it.
2. If it qualifies: fill in the declaration
In Play Console, open Policy, then App content, and complete the declaration for this permission: the feature that needs it, why no alternative works, and, when Play Console asks for it, a short video of the feature.
3. Otherwise: remove it, including from libraries
Use no VpnService at all when the feature does not need a device-level tunnel, for example a per-app proxy or a server-side filter. If a dependency adds the permission, remove it from the merged manifest:
Remove the corresponding declarations from the manifest, then rebuild.
Check before you submit
Upload the APK, AAB or split-APK set (XAPK, APKS, APKM) on the store check page. It runs PLAY-PERMISSION-DECLARATION against the dates on this page, then deletes the file: nothing about the app is kept.
FAQ
A library added this permission. Is my app concerned?
Yes. Google reviews the uploaded build, and its merged manifest includes the permissions of every dependency. Remove it with tools:node="remove" if the app does not need it.
Does the store check tell me whether my use is allowed?
No. It detects the permission in the build and tells you a declaration is needed. Whether the use qualifies is Google's review decision.