Google Play keeps detecting collection of personal and sensitive information, rejecting my app

What are the side effects on the playstore if those options are checked as in your example? What limitations may happen, you get excluded from certain search results? Some countries may not be available? Is just an annoyance placebo (like with the cookies Europe gdpr rules that nobody cares about in the end) or google will punish your content if you have those those options up?

If indeed one collect sensitive data from the player, then it should inform the user so he can make a clear decision if he wants to use the app or not but if one doesn't collect anything then is not a good solution as may limit the app reach

 

Annoyance placebo I think. I've been searching through similar games to mine on Google Play and they ask the same permissions - if not more, so I don't think this is a problem.

On its Google Play page when I click View Details under Permissions, you get:

Showing permissions for all versions of this app
This app has access to:
Other

• full network access
• allow Wi-Fi Multicast reception
• view network connections

TBH I can't remember what it said before. The game has in-app purchases; no subscriptions.

No searches on Google Play but the precise game title make it appear. So no change there. Financially I'm now getting about 3p a month: no harm done.

 

Google Play keeps rejecting my app even after I "admit" that I collect sensitive information.
(Even though I am not collecting any information at all.)

This is what Google Play says now:

----------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------


Publishing status: Rejected

After review, your app has been rejected and wasn't published due to a policy violation.

Families ad format requirements
Your app contains ads that do not comply with our Families ad format requirements. For example, the following is prohibited:

• Ads or offers for in-app purchases that are not clearly distinguishable from your app content: For example, your app contains an ad that is not clearly labeled, or your app contains an ad that is styled similar to the game interface.

----------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------

Google Play also provided this image: (The two first images is screenshots from my app and the last one is the "problematic add")

So ok, the add is not clearly distinguishable from my app content, but what can I do about this? I have no control over how the ads are designed.

 

I'm not sure this is the correct thread for this issue. But in the last screenshot what is your interface and what is the add? The top right timer?

 

In the last screenshot (the image to the right) is the Unity ads alone and nothing from my app is shown there. The ad starts when you choose a dish from the menu, like clicking on the hotdog.

 

My new build from 2020.1.0b15 is still being denied. Do we need to removed the ads/analytics/IAP packages or do we keep them and just turn them off?

 

Did you ever figure it out? I'm having the same problem

 

Changing it to Yes basically means you actually do collect information and you will have a warning that associates your app with data collection

 

When you install my game now on Android devices no warnings are displayed, I have tested this on five different ones. Installation is exactly the same as before. Games like mine ask the same permissions and in most cases, more, including storage-related permissions.

Also, my game doesn't have an in-game privacy policy either: it didn't need one when I made it and even though I've admitted collecting data now it was still re-approved for the PlayStore.

I'm not saying admitting to data collection is a good thing nor that Unity shouldn't fix it. I just wanted to get my game back back out there.

 

@Unity seriously!! LOOK INTO THIS DAMN ISSUE! SPEAK TO GOOGLE ABOUT THIS NONSENSE

 

Our app was actually being rejected because of another apk that we had in the Internal Test Track branch of releases in Google Play. This was an extremely old build that we made before actually releasing the app, to test IAPs and general usage. Update ALL your branches! Test, Alpha, Beta, Production...

It only took 2 months, 10 apk submissions, and countless emails/form fills to Google met with automated and generic responses until a support person FINALLY told us that the rejected build wasn't the one we were submitting!

Since apparently you can't delete those apks, what we did was upload our most recent build to Internal Test Track, then promote it to Alpha to overwrite one we had there, and then finally to Production.

Their rejection emails are completely useless. They only tell us we are using the Android ID (we are, explained in the privacy policy) and Advertising ID (we aren't). Not a single clue that it was another (older) apk.

In our powerlessness, we had already disabled all analytics, updated Unity to 2019.4.1f1, added a privacy policy screen on startup, updated privacy policy to explain our usage of the Android ID (hashed and we use only 5 bytes), moved a microphone permission to a different place, etc. All to no avail.

It.
Was.
Another.
F******.
Build.

/endrant

FUN FACT: We have another app that also has an old build in the Internal Test Track and was rejected, but they passed it after we criticized their decision. At the time we had no idea what happened. Now we know. Hooray to reviewers not following the same review process. Same with Apple.

 

Unity 2017.4.35.f1
Game update - previous game version compiled with the same version of the editor, submitted in February,
PEGI3 - family friendly
No Ads
No in game purchases
I haven't used any plugins or external packages.

I added the link to rate the game in the appStore, Application.OpenURL to the game rating page in google playstore
Apart from this the game does not using internet at all.
May the link be an issue?

Publishing status: Rejected

Your app has been rejected and wasn't published due to a policy violation. If you submitted an update, the previous version of your app is still available on Google Play.

Issue: Violation of Families Policy Requirements

We detected that your app collects personal and sensitive information from children, but this was not disclosed in your Play Console. Apps that include children in the target audience must comply with all Families Policy Requirements, which requires that you disclose the collection of any personal and sensitive information in your app, including through APIs and SDKs called or used in your app.

Next steps: Submit your app for another review

1. Read through the Data Collection section of Families Policy Requirements for more details.
2. Review the App Content > Target audience and content section in your Play Console. Be sure to disclose the collection of personal information in this section. And, if applicable, you must collect verifiable parental consent before collecting any personal and sensitive information from children.
3. Before submitting, make sure that your app is compliant with all other Developer Program Policies. Additional enforcement could occur if there are further policy violations.
4. Select Store presence > Store listing and click Resubmit app.

 

Hi,

I fixed the issue as per CanisLupus advice. I said that game collects some information (in the playstore and explained in the privacy policy:

What information do we collect?

1. Data collected by Unity Engine

Application is made with Unity Engine engine the engine can collect standard data, please see below paragraph from Unity Privacy Policy:

I play a game built with Unity software, what should I know?

Unity has collected some or all of the following information about your device: unique device identifiers (e.g., IDFV for iOS devices and Android ID for Android devices); IP address; country of install (mapped from IP address); device manufacturer and model platform type (iOS, Android, Mac, Windows, etc.) and the operating system and version running on your system or device; language; CPU information such as model, the number of CPUs present, frequency, and instruction set support flags; the graphics card type and vendor name; graphics card driver name and version (e.g., “nv4disp.dll 6.10.93.71”); which graphics API is in use (e.g., “OpenGL 2.1” or “Direct3D 9.0c”); amount of system and video RAM present; current screen resolution; version of the Unity Editor used to create the game; sensor flags (e.g., device support for gyroscope, touch pressure or accelerometer); application or bundle identification (“app ID”) of the game installed; unique advertising identifiers provided for iOS and Android devices (e.g., IDFA or Android Ad ID); and a checksum of all the data that gets sent to verify that it transmitted correctly.

Farther reading on Unity Privacy Policy:

Unity Privacy Policy

The game was approved and still in the Family Program

 

@LOSTSOUL86 Hi, could you tell me where did you put this whole text ? On the store page description ?
They only accept a single link in the privacy policy field.

In the rejection mail they keep sending me, they joined a screenshot of the start of this page : https://unity3d.com/legal/privacy-policy so I'm guessing it's not good enough anymore, probably too vague as it is.

 

Hi,

I have the same problem, I tried to publish using my app that contains Firebase Analytics, then I remove this plugin and I still have the reject. I use Unity 2019.1.8f1

@JeffDUnity3D Any update about this ? Is this fixed on v2019.4.9f1 or v2020.1.3f1 ?

Thank you.

 

I published my app using Unity2019.4.9f1 and it works

 

We're still getting rejected after updating to Unity 2019.4.9f1. We're only using Firebase Analytics and Vuforia. Any ideas?

 

Same problem with version 2019.4.14.f1. I'm only using Unity's IAP package (and handicapped Unity analytics just to make the IAP work). Got approved by Apple in their "Designed for Kids/Families (or whatever)" program, but Google keeps rejecting it saying that we're collecting Advertising ID and Device ID.
Obviously that's a problem with the engine. I've checked everything with Charles, went through every possible guide (hence approved by Apple after some trial and error).

I can't contact Unity's support on this either, since they don't do technical stuff and won't help me to remove DeviceID calls from Unity's binary output. I thought a Pro license would cover that.
I really need some support.

 

Never mind. Turns out that Google Play reviewers have no idea how their own system works. Developers have to submit a new build to all active test and production branches otherwise it gets rejected.
See post https://forum.unity.com/threads/goo...n-rejecting-my-app.885223/page-3#post-6103743

I was trying to make an internal test build before releasing an update. So Google was reviewing a 2 year old production version instead of the one I was uploading. I still can't believe it, they're literally worse than Apple.

 

So as per the screenshot in https://forum.unity.com/threads/goo...n-rejecting-my-app.885223/page-2#post-6000224 "Android: Unity analytics does not get advertising ID anymore", does it mean if I am using Unity Editor 2019.4.15f1 and later that Unity Ads, IAP and the included Analytics don't collect "personal and sensitive information" mentioned in app details anymore and that I don't need to use the settings below?

My Advertisement package version is 3.6.1 or later and In App Purchasing package version is 2.1.1 or later.

Also, should I answer Yes or No to the collecting "personal and sensitive information" question?

Edit: Thanks in advanced.

Edit2: According to https://docs.unity3d.com/Manual/UnityAnalyticsCOPPA.html , "In order to provide analytics for your games, Unity Analytics
generates an anonymized user ID for each user in your game. We do not use any of these IDs generated from Child Apps to track users across apps built by other developers or to map users between different services, devices, or browsers on the same computer. In addition to these IDs, Unity Analytics also collects the following personal information from Child App users: IP address, identifiers for advertisers (IDFA is only collected if Unity Ads is also enabled) and device identifiers (IDFV, Android device ID or IMEI if Android device ID is unavailable)."

Are IP address, identifiers for advertisers and device identifiers considered personal and sensitive information?

 

Yes! This was our issue as well. An older build in the Test Tracks kept flagging the new submission. We cleared everything and submitted a new update and it got approved

 

I am sorry for resurrecting this but this post echoed so many of the troubles I have been encountering with Google Play.
It is by far the S***tiest platform ever. You have to get ready to deal with bots with fake human names that do not provide any useful information, and be ready to possibly find yourself wasting ungodly amounts of time.

I couldn't second this more. I have recently realized this too. Your tracks are NOT independent!
The Console is so messed up that it cannot even agree with itself depending on whether you're looking at an internal/alpha/beta track or the App Bundle Explorer.
It's a laughable joke.
The entire Google system is over-engineered, it's a pain, it's a maze, it's messed up beyond belief.
The sheer, complete incompetence that is at play at Google is nothing short of totally insane!

Exact same story. It is that stupid. I have been delaying a full release, including translation, because of things like this.
I have spent months trying to get through the issue of them saying that my testing releases were not fit for the Designed for Families program (the bundles always got a "conditionally passed" tag), despite the fact that in App Content it's literally written that my app DOES NOT belong to this flipping program!!
I kept returning into stupid and never ending cycle of bot-bot-bot sorry two business days etc. Imagine how much time you're losing chasing their own failures!

They have also been telling me I had to deactivate bundles... which you cannot do. All you can do is make new releases and deactivate channels, assuming you use alpha or beta releases, otherwise in internal since it's just one big track it's all or nothing.
Picture this: the A.B.E. is able to tell me that some bundles are active despite the fact that:

• they are used in deactivated channels!
• never ever got the damned green checkmark!

How can it get more stupid than that really??

Yes, that's the path to follow... when the Console doesn't literally eat up own of your uploads and corrupts a release, making it impossible to be modified and not providing a way to add an already added bundle or upload a new one.

This is not all. Here's something fun about the Internal track.
I have deactivated all alpha channels and have no beta open yet.
There's that link in Testers, in the Internal track, to go grab your app from the Play Store.
If I copy and paste it, it opens a page that literally uses an old obsolete logo and points to an old version that is only referenced in an ALPHA channel, despite my Internal release being green check marked!
Yes, wrong bundle, wrong track.

There's also that summary of each release in Internal that says that your app is available in a given number of countries, despite the fact that regional targeting is literally IMPOSSIBLE in the Internal track as per their documentation.
There aren't enough facepalms for this sh*t really.

The chief executing officer of that entire department should get fired for this. Such BS has been going on for years!

Absolutely useless indeed!

And I am most certain that after a while, you entered a phase wherein the bots kept saying you had to deactivate a given build, as if there was any way to actually do this operation directly, like by pressing on a simple button (duh) without resorting to the convoluted demoting of a bundle by forcing a new one into all tracks.
I mean, who the f*** even thinks like that?

As far as my experience goes, working with Apple's AppConnect system has been a joyful breeze in comparison and they don't spam you with robotrash email like Google does.
Google is all about AIs AIs AIs but we see how far this nonsense goes and it's pathetic and unreliable.

 

This helped me once when I had to deactivate an APK I guess you can do the same for bundles:

"
So now the question is what can you do to deactivate it? The answer is a bit confusing in the UI, but makes sense once you think about it. You need to

• create a release with NO (0!) APKs in it
• publish that release to the beta track

This tells Play that you deliberately want there to be no active APKs in Beta. These users will still get production APKs, but your old beta APK will no longer be active. We're sorry this got confusing, you were caught by a subtle edge case.

"
From: https://stackoverflow.com/questions/52420414/remove-obsolete-beta-version-from-google-play

 

I have found a reason why any game/app made with Unity cannot be targeted to include any children.

In Unity's Privacy Policy page ( https://unity3d.com/legal/privacy-policy) under the section
"I play a game that was built with or uses certain Unity software, what should I know?",
It says Unity collects "unique advertising identifiers", e.g. "Android Ad ID".

This does not square up with the recent (Nov 16 2021) Google Play Developer Policy Updates 2021 - APAC /EMEA video:

Precisely, at 25:17 (&t=1505s), that second bullet point, which says "You must not transmit Android advertising identifier (AAID), ... from children or users of unknown age".

I hope I'm wrong about how I'm reading this! I would really like to include children with my target audience, and apply my educational app to the Designed for Families Program. (App is free and does not have any ads. It just uses vanilla Unity, no analytics/packages at all, only regular Unity and I don't collect/share anything.)

A separate issue I'm wondering about is Google's own confusing presentation to explain details about how to answer if your app "collects" data. https://support.google.com/googleplay/android-developer/answer/10787469 under "Data Collection" section, that seems to very much include Unity-developed games/apps in both its definition at the top and the first bullet point of "Libraries and SDKs". I am thinking, parents would want to know about this. However, at the bottom of this same section, it gives some potential out because of "end-to-end encryption"-- which I believe @JeffDUnity3D has explained that Unity satisfies, because Unity sends its data over SSL connections. Just because it's transmitted securely, data is still "collected"-- isn't the the entire point of including this disclosure?

Besides using Charles Proxy, couldn't there just be a list of examples that Unity devs can look up to see how to properly answer, depending on what kind of Unity app we made? Like we choose "regular Unity, no packages" , "with Unity Ads", "Analytics", etc. Even for just the most popular publishing scenarios.

 

Nice post.

FWIW, the GPC did send me a large number of stupid warnings during development, some about violations regarding the Designed for Families, even when my app is not designed for this segment and specifically kept out of it. Sometimes their robots posted random garbage, sometimes outrageously long lists that were like a collection of all things that could go wrong with an app, often under "Conditionally Passed". I wasted tons of time trying to solve them ahead of further uploads when in fact the best option is just to run the blockade and see what goes on when publishing at the higher level. Otherwise you'll get mad trying to comply with all sorts of Googlean nonsense. Just force your way through and f*** robots.

 

Another ref from Google's Families Policy Requirements (#5, first bullet point):
https://support.google.com/googleplay/android-developer/answer/9893335

Thank you Starbox. I feel very bad for you and @CanisLupis to have had to go through all that heartburn. It's one thing to labor over code to create software, but going through the publishing process with such stress would drive me nuts. Reminds me, I tried claiming a knowledge panel this year numerous times, went through all kinds of hoops but just got caught in a loop of canned responses back from Google, and never got it. and I have my doubts about sympathies for this kind of struggle from the general public, given 61% of apps not being upfront about what they send
ref: https://www.washingtonpost.com/technology/2021/08/29/facebook-privacy-monopoly/
and this one (it focuses on Apple, but 61% of top Iphone apps not being upfront about tracking can't give the general public a nice safe feeling about apps in general). https://www.washingtonpost.com/technology/2021/09/23/iphone-tracking/ Is it just part of the overall price of everything being "free"?

My Google Play Console's Data Safety section for my app says, "App doesn't collect or share data". (It does because it uses Unity? but has end-to-end encryption so is exempt??) It has my "security practices" at "Data isn't encrypted" (actually it is, by SSL, but it thinks my app doesn't collect data) and "Data can't be deleted". I haven't had the problems described in this thread, but it doesn't seem right to me. I just wish it were a lot more clear.

 

I'm afraid even with a 'paid' model, data leaking is now a staple and legal powers, for what they're still worth, are trailing eons behind until another big company stomps into the courts.

 

If this is true, can this be stated explicitly in Unity's Privacy Policy? I trust you as an authoritative source, and I'm happy to hear it-- just saying, this was not clear to me, in light of the official Privacy Policy page.

Unity's page on CCPA (California's law similar to Europe's GDPR) seems to be more consistent with what you're saying, making more of a distinction between whether or not a game has Unity Ads, but the Privacy Policy page leaves this point vague, and the reader would logically (and may legally) conclude that core Unity does indeed collect Ad ID.

The CCPA page seems to try to make some point about how, to paraphrase it, "Unity would never *gasp* sell your personal information, because of Unity's definition of sell you see, but actually according to the law, um, we do." Otherwise, the general tone of Unity's legal pages is good and practical.

 

Maybe it is safer to assume that a level of data leaking and selling occurs but try to find a legal choice that corresponds to a low intensity leak. Sort of.

 

Lol, this is funny.

Then a couple of sentences later.

Lol.

 

So they don't sell it, they "just" share it. Ahem.

 

I just finished a new children's game, and was going to publish it to Google Play.

But their Families Policy Requirements says: "You must not transmit Android advertising identifier"
And Unity privacy policiy says: "Unity has collected (...) unique advertising identifiers"

So it's not possible at all to create a children's game with Unity? Or are there any workarounds you can do? Maybe manually removing the internet permission from the app, so it can't be transmitted?

 

No ads. Version 2019.4.12f1

The problem is that your privacy policy says that you always collect the advertising ID. For all versions of Unity, and even when there are no ads. That is not compatible with the Google Play Family Policy.

 

Did you have uploaded the game to google play and got rejected or this is a preliminary question about a mismatch between google play requirements and what unity states inside their own privacy policy?

Because this is a thread about google rejecting the apps for various reasons.

But don't get me wrong I'm curious about the answer to your question.

But also looking at this page

https://support.google.com/googleplay/android-developer/answer/9283445?hl=en

if you are targeting the Google Play Family Policy, you can see that there are certified SDKs for unity, approved by google for this specific ad program. So if you follow those instructions and you use the code provided there should not be a problem between you google and unity.

I think they have some deal behind the scene on what they can get from the users of the app, ecc

I'm speculating but maybe unity will behave differently, will collect information differently if the build is set to use those SDKs. This to conform with google legal requirements.

So maybe you are reading the wrong unity policies. you need to check those that are related to those google approved SDKs

Edit: or maybe I'm reading all this wrong. don't mind me.

 

I was going to upload it, but stopped when I read their family policy. I dont't want to get it rejected. That may increase the risk of getting my account suspended.

That page says it's ok to use Unity ads, but it doesn't say about Unity game engine. My game doesn't have ads, but it looks like Unity will collect and share the ad Id anyway.

I would prefer not to guess what Unity is doing. If they are not collecting the ad ID in every game, they should say so in their privacy policy.

This is about in app purchases. I don't use that. No ads. No IAP. No analytics.

Do you have a similay sheet for just plain games with no services added?

 

I wish you good luck because anything related to management of family-oriented polices at Google is like a walk through Hell. If your game does not specifically target kids (yet is labeled as 3+ or alike after filling Google's own Age Ranking form), then do not include them in your age ranking at all. Parents will do their job on their own end of the responsibility chain. I wasted an insane (and precious) amount of time fighting against the whole system trying to come up with a set up that was in harmony with Google's requirements, warnings and clues.

 

We are having the same issue where the latest update of our app is being rejected by GooglePlay because it "transmits device identifier(s) from children or users of unknown age that do not comply with the Families Policy. These identifiers may include but are not limited to [Build Serial Number]"

We use unity IAP and unity analytics but we don't use ads. We aren't sure if unity is the problem as we use several plugins in our app and are still in the process of checking each one.

I'm wondering if someone could confirm that we can indeed use Unity IAP and Unity analytics but NOT unity ads and still be approved for Google's Families Policy. And if so, what settings etc. we need to do/check to make sure.

We are currently using Unity 2020.3.27f1 and Unity IAP package 4.1.2.

Thank you for any feedback and support you can give us.

 

That's good to hear. Thank you. I just wish that this could have been written in an official document too.

So I removed everything about ad ID from my privacy policy, and uploaded the game to Google Play. And it worked. It was not rejected

 

we have an app on Google Play Store in the child category. We have to update this app but there is a problem with the new Google policy. The application is rejected by the play console. Because of transmitting [Build Serial Number]. My app targets kids also using some AR functionality which never violates the policy. we detected that unity collects the build serial number(libunity.so file).an anyone help me to resolve the issue?
unity version: 2019.4.15f1
@JeffDUnity3D

 

it appears you know what are you doing. can you track where that data is sent? is a unity server or something else?

 

IDK where the data is sending

 

Is it specifically targeting kids or are kids just part of your overall audience?
In the latter case, increase your rating to PG13 and just assume the parents will do the proper parenting.