California Attorney General Kamala D. Harris reached an agreement with six of the largest companies in the mobile-device market that could change how app makers handle personal data and the way millions of people download apps.

Ms. Harris said Wednesday that Apple Inc., Google Inc., Amazon.com Inc., Microsoft Corp., Hewlett-Packard Co. and Research In Motion Ltd. agreed that California law requires apps to have privacy policies, and that they would begin asking app developers who collect personal information to include them.

Ms. Harris said, some 22 of the 30 most-downloaded mobile apps don't have privacy policies. "We have populations without knowledge of [mobile technology's] potential uses who are potentially vulnerable," she said; "We seek to give them tools to protect themselves."

While the agreement specifically applies to enforcement of a 2004 California law requiring privacy policies, it will benefit "users everywhere," she added. Previously, California law has been used to require privacy policies from websites, but it was unclear if it applied to apps.

California's deal with the companies stops short of saying that they will enforce privacy-policy requirements or kick apps that don't have a policy out of their stores. The state is responsible for enforcing the law, but the companies agreed they would help educate developers on their legal obligations.

Ms. Harris said that the companies were participating voluntarily in "good faith" with the effort, and that they planned to meet again in six months to see how the effort was progressing.

A Google spokesman declined to say how the company would enforce the rules on its Android-smartphone app store. In a statement, he said, "From the beginning, Android has had an industry-leading permissions system which informs consumers what data an app can access and requires user approval before installation. Coupled with the announced principles, which we expect to complete in the coming weeks, consumers will have even more ways to make informed decisions when it comes to their privacy."

A Research In Motion spokeswoman said: "We're looking forward to working with the attorney general of California and the application-developer community to further build out the necessary tools that will help facilitate the ability of our application developers to bring greater user awareness of their privacy policies and practices."

"Microsoft is committed to being a leader in consumer privacy across all of our products and services. We are pleased to endorse the statement of principles and to support the work of Attorney General Harris," said a Microsoft spokeswoman.

An Apple spokesman confirmed the company's participation in the agreement, but declined to comment further. An Amazon spokeswoman declined to comment. H-P didn't respond to requests for comment.

Most consumers don't read website privacy policies, which often contain vague legal language designed to be as broad as possible to shield companies, rather than to specify exactly what information is being collected.

In an interview, Ms. Harris said thatshe agreed most privacy policies are "absolutely beyond the understanding of the average person," but that the six companies agreed in principle that app privacy policies "are going to be more clear and understandable."She said simply requiring privacy policies would force app developers to think about what information they are requiring from consumers—and why. Moreover, she said, the policies would give her office the ability to prosecute app makers that took or used consumer information in ways that ran counter to them.

"It is important that it creates a hook for enforcement that did not exist before, which is the only hook that typically exists for privacy enforcement in this country," said Justin Brookman, the director of consumer privacy at the Center for Democracy & Technology in Washington.

A study of 101 popular apps that was part of The Wall Street Journal's "What They Know" series in late 2010 found that 56 of them transmitted the phone's unique device ID to other companies without users' awareness or consent. Forty-seven apps transmitted the phone's location in some way, while five sent age, gender and other personal details to outsiders.

Last week, the Federal Trade Commission published a working document that urged developers of mobile apps for children to provide more information on data collection and said it plans to review whether apps violate child privacy laws.

Separately on Wednesday, 36 attorneys general, including California's Ms. Harris, sent an open letter to Google protesting its new privacy policy, set to take effect in March. In the letter, they said the policy "appears to invade consumer privacy by automatically sharing personal information consumers input into one Google product with all Google products."

The letter asks for Google to respond by Feb. 29.

The Google spokesman said its updated privacy policy will make its privacy practices "easier to understand" and reflects its desire to create a "seamless experience" for signed-in users. We've undertaken the most extensive notification effort in Google's history, and we're continuing to offer choice and control over how people use our services. Of course we are happy to discuss this approach with regulators globally.