Google play Violation of Advertising ID

So I got an email from google saying


Issue: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement

Google Play requires developers to provide a valid privacy policy when the app requests or handles sensitive user or device information. We’ve identified that your app collects and transmits the Android advertising identifier, which is subject to a privacy policy requirement. If your app collects the Android advertising ID, you must provide a valid privacy policy in both the designated field in the Play Console, and from within the app.


I don't have ads on my game yet I get this.
Should I just humor them and add a Privacy policy?

 

I have the same issue

 

Same here

 

We have the same issue, Advertising ID is not used in the game explicitly and the game was just removed from store without any warning before that action.

 

Same. No ads whatsoever in the game and removed.

 

Same here. We don't use advertising or store personal data, yet it still got removed. I reckon it's probably still in the exported code somewhere, triggering the scan.

Question is; do we pretend that we do by adding a privacy policy, or is this something that can be fixed otherwise? Would hate to have to add a privacy policy even though we don't save any data.

 

Yeah it seems odd to have to write a privacy policy when I'm not collecting data. I don't fully understand what unity is doing to trigger this, hopefully they will respond.

 

I hear it's the Android SDK that report crash data with user info. There's a app setting somewhere but you'd need to recompile. It's easier/quicker to write up a privacy policy.

I wrote this

Privacy Policy
This app does NOT activily collect user data or id for 3rd party use. Android and Google Play does collect crash data information.

 

Seems to be same issue here too.

Would be really nice to get actual solution to this.

 

same issue here too

 

Hi guys, I had same problem with my game https://play.google.com/store/apps/details?id=com.sekip.rainbowanimals (my least successful game) but still I wanted to fix that. I have 13 games at Google Play Store and problem was in this one.

In my games I am using GoogleAds, GooglePlayServices and Firebase.

So I looked my libs and I figure out that I need play-services in min version 10.0.1 or higher. And for my sure I put this line on code to manifest:

<meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />

After update is now at Google Play without creating privace policy document.

I hope this will helpful for someone.

Cheers.

 

My game Cognizer just got this notification. Again, I have no ads in my game. It's free with blank donation DLC.

 

i can just add a link to the website that just telling

Privacy Policy
This app does NOT activily collect user data or id for 3rd party use. Android and Google Play does collect crash data information.

??

 

And do you have some other plugins like Google Play Services, Crashlytics or Unity Analytics in your game?

 

Even if you dont use the Advertisement ID on purpose, Check for librarys that do. (for example all AD providers, including unity, all analitycs ...etc) So if one of the librarys use the Advertisement ID you must specify it in the privacy policies, on the googel play and in the game itselft

 

I'm experiencing the same issue. I've gone through all of my code, I don't use the advertising identifier anywhere, and the only plugins I'm using are TextMesh Pro and uDialog, neither of which seem to (nor should) use the advertising identifier. I also double checked that Unity Analytics and Ads were disabled (I have all Unity services disabled). My guess is that some baked-in code for either Unity analytics or ads is still manipulating the identifier, even though the services are disabled.

 

Same issue here. No use of the the advertising identifier directly, nor use of ads, analytics or any assets that would have a plausible reason for using it.

 

Could it be Unity Analytics using it?

 

It happens to regular Android developers too.

 

here the solution https://medium.com/@swarooptvm/how-...y-violation-in-google-play-store-6d9cf92d335d

 

Yesterday my game got removed too. After reading this and other threads about this problem it seems that Unity collects some data including the Android Advertising ID (source: https://unity3d.com/es/legal/privacy-policy)

I found this in Stackoverflow: https://stackoverflow.com/a/52401605. The problem is that the plugin only works if you use Unity Analitics, which I don't.

So what are my options to solve this issue and to enable my users to opt-out of the data collection that Unity does? I'm losing SERIOUS money and of course this will have a tremendous impact on my daily downloads after my app gets restored.

PLEASE UNITY WE NEED HELP!

 

I'm getting the same issue with two games, contacted unity but not sure if they will respond soon, I was using 2018.2.5 when I made these games so the issue won't be priorized .

@mistergreen2016 can you confirm that? or at least post the link here you saw it.

Edit:
I'm only using Unity services (Analytics with COPPA and Peformance reporting). I'm also using GogglePlayVerification but it should not be the cause of this issue.

 

@absrndm if you are using the unity 2018 you can use the package mananger to remove both Ads and Analytics (and for good measure the IAP) from your project.

Apparently Unity Analytics will collect some personal informantion from the user, but IDFA should only be collected if Ads is enabled. Since Ads wasn't enabled in both of my games, I guess is this is some kind of bug with the Ads package.
Ref: https://docs.unity3d.com/2018.2/Documentation/Manual/UnityAnalyticsCOPPA.html;

 

Thank you for your suggestion, thing is I'm still using Unity 5.5.6. And as they state in their privacy policy it seems they collect data from Unity itself. I'm gonna try to link their privacy policy in the store listing and a link to it inside my game. I really hope its enough to comply with Google policies.

 

As ronald_unity851 wrote:

SOLUTION:
1. Create Privacy Policy document with https://app-privacy-policy-generator.firebaseapp.com/
2. Copy and\or make it html file.
2. Place the Privacy Policy html file on your website (you'd better have one, if you published a game). i don't know if any other link will work (e.g. google drive or such).
3. Go to your Developer Console > Store Presence > Store listing: at the bottom paste the link to your Privacy Policy page.
4. Re-submit your app.
5. It will be approved within several hours and it will be live on Google Play again.

many thanx to Swaroop S
https://medium.com/@swarooptvm/how-...y-violation-in-google-play-store-6d9cf92d335d
and ronald_unity851

good luck

 

Thank you mckeithen & ronald_unity851 for this solution. Indeed from more than a year Google require a privacy policy statement for all apps, whatever they collect users data or not.

 

Then they should remove the option to add a Privacy Policy and just make it mandatory.

 

This is an ongoing issue. We don't use Ads in our game - but we do use UnityIAP (which in turn requires Analytics). Unity really needs to remove the dependency between IAP and Analytics *immediately*, as having it is screwing over developers.

The previous solution of "add a privacy policy URL" is apparently no longer sufficient for Google. Apps now have to present the privacy policy to the user *AT THE TIME THE ADVERTISING ID IS REQUESTED*. As we have no control over that, apps that use UnityIAP/Analytics are no longer viable on Google Play.

 

Same as you. No ads whatsoever. Just IAP.

I'm seriously considering abandoning Unity IAP and going with some package off the Asset store instead that won't have this Google Advertising ID issue. Has anyone gone that route?

I'm attempting to get back onto the Google store by popping up the Unity Privacy Plug In page right at the beginning when the user starts the game for the first time to get it over with. And then burying a Privacy button on the Settings page so he can do it later if he wants to. It makes for a relatively horrible new user experience but at least it was fairly painless to do.

If it's not enough though and my apps get removed from the store again, I'm probably going to start looking at other IAP (and possibly Multiplayer) solutions.

 

What's annoying is that they don't give us details on what exactly they found. Are they scanning our binaries and maybe picking up something in a method that may not even be getting called? Are they detecting that the Google Advertising ID was actually requested? Are they analyzing a crash report that they received? Who knows?

All they say is "You're using the Google Advertising ID". Violation!!! Which is incredibly annoying for coders who are not using it themselves.

You guys are also not being terribly transparent (unless I've missed something) on why exactly it is being used by Analytics for coders who are not making use of Unity Ads. Does it function as some sort of unique key for you guys on Android and there's nothing else easily available?

 

If it helps resolve the issue I have documented my experience with it here: http://www.zuluonezero.net/2019/02/...-4-8-of-the-developer-distribution-agreement/
My game has no need for IAP or Analytics (It's a demo of a framework).
I have removed all third party and Unity additional packages so that my build is basically just what you get when you open a fresh project with in Unity with no "extras". My game just got turfed from the Play Store for a third time after even this most basic build. So the use of the Android ID is part of the base packages - you cannot remove this function yourself without a bit of support from Unity
I'm going to put up a privacy policy on my website and resubmit without any changes and see if that works.

 

I have a simple question that has been surprisingly hard to answer: Can I make Unity stop collecting any data at all?

I've disabled every analytics checkbox, and ads package and analytics service and whatever else I could think (all of them enabled by default) and I still don't know if I've stopped data collection.

Reading your privacy policy ( https://unity3d.com/legal/privacy-policy ) makes it sound like no matter what I do, some or a lot of information may be collected (including Android ID for Android devices, which is generally a big no-no and Google advises against using it for anything and AD IDs).

We are put in a position to write privacy policies these days, it doesn't help if we don't know what happens.

For all I know, all the checkboxes I'm obsessively un-ticking are as useless as the "Editor Analytics" checkbox, which until a couple of weeks ago wasn't really stopping the editor from sending data.

 

From what I've read/seen.

If you're using the Free version, there is no way to do that provided you are making use of Unity IAP or Analytics or Multiplayer.You need to offer your customers the opportunity to opt out using the Privacy plugin. I think even then, info gets collected, it just gets anonymized.

If you're using Plus or Paid, there is a flag you can set in the editor that will stop the Advertising ID from being brought in.

 

Okay, but can I stop ALL collection?

 

I just read your blog entry. That will be very helpful to people hitting this for the first time.

You wrote

The reason that the app was removed was because we had included the Unity plugins for Analytics and Advertising

Google does not state this or anything close to as precise to that in their email (at least they didn't for me). We're all sort of assuming that it is the case.

Your app may in fact have been removed simply because the Privacy Policy field in the store was empty....but they do imply otherwise. They definitely make it sound like they have noticed something in the behavior of our apps.

The Privacy Policy field in the Play store is still behaving very much as though it is a de-facto optional field which CAN be left blank. They did a wonderful job of not letting me adjust anything before I had modified the price of my app in Paraguay because they had made some sort of change regarding that country recently, but they were not alarmed at the least that my Privacy Policy field was empty.

 

Don't think so. If you visit the page for the Privacy Plugin, Unity says that if your app uses Analytics, IAP, Multiplayer, etc, etc. that you must (my emphasis) use the privacy plugin

It implies that there isn't another way to comply with GDPR.

Worth mentioning that the letter/notice from Google says nothing about GDPR. It is all about a Google policy regarding the use of one little piece of their data that is being violated.

 

I meant with all that disabled. (and I'm pretty sure the answer is still no, or at least Unity's privacy policy is unclear on this)

 

My understanding is that there isn't any Unity data collection if you don't enable any of those options. It seems to all come down to whether Analytics gets enabled or not.

 

If you read the privacy policy, specifically the part "I play a game built with Unity software, what should I know?", you will notice that the first paragraph talks about a whole bunch of stuff Unity collects, and then the second paragraph it talks about what gets collected when Analytics and Ads are enabled.

Which is making me think that some collection happens regardless of the setting of those options.

 

So, this is truly bizarre on Google's end.

I've been working hard the past few days trying to update the app they complained about. I have a new version that uses the Unity Privacy plugin and I pop that up for users right when they start their very first game and I also provide access through my Settings panel.

I also updated my Unity IAP library from v1.18 to v1.22 - after I fully test IAP on an app I don't like to update the library any more.

Submitted it as a beta version and was planning on running full IAP tests as well as tests on the privacy stuff before releasing it to everyone.

A half hour ago I completed tests on the Privacy portion but wasn't able to test IAP because I have already purchased all of my app's normal IAPs and Google auto restores all purchases when you reinstall. So I need to create a dummy IAP and upload a new test version to finish my tests to verify that Unity IAP 1.22 works with my old IAP code.

I just logged on to Google Play to create my dummy test IAP and my app has been put back on the store. I still do not have a Privacy Policy in my store listing and I have not uploaded a new version to customers. I'm back to normal - after having being blacklisted for 2 weeks - as if nothing had happened.

 

I got a pretty good idea that it was the Advertising Plugin as Google's mail identified that the app collects the Ad ID (but you're right I can only assume that's going to be either Analytics or Advertising). At least I know for certain it wasn't my code So in the end I made no changes to my App and just put a link to my "new" privacy policy on the website and updated the Play Store link. That seems to have sorted the issue.

 

Yeah, they flagged the Advertising ID for me too but I don't use advertising.

It's really not clear what is happening. As I mentioned in my previous message, Google put my app back on the store after I submitted a new beta version and still having a blank privacy policy and still pulling in the Advertising ID. I should have tried deleting my new beta right after I saw that to see if they would pull my app off again.

I have a feeling they are going to be coming down heavy on this stuff fairly soon, but they're not quite ready yet. This all looks like little snippets of half baked logic on their end kicking in as if they're only running tests at the moment.

Glad you got it sorted.

 

My app too was removed. Just using IAP and got removed.
Please let us know what we should do.

 

I wrote to unity and got this reply

Hi Tim,

You are not the only developer to have recently encountered this issue. Unfortunately, based on the experiences of other developers, we have not isolated the root cause for Google's actions. When Unity asked Google what was up with this, they responded "Inconsistent enforcement is unfortunately an outcome of managing a store of Play's vastness at scale. So I'm afraid I can't help give clarity there." So, we're still guessing, but at this point the issue seems procedural and not anything wrong with Unity coding or developer coding.

Some users have found success by adding a link to their own privacy policy (or someone else's privacy policy) in the appropriate privacy policy box when resubmitting to Play. However, some users have done nothing and seen their apps reappear in the store. Here are two forum threads where other users are discussing their experiences and solutions:
https://forum.unity.com/threads/google-play-violation-of-advertising-id.558010/
https://forum.unity.com/threads/update-your-privacy-policy-google-removing-games-from-store.558940/

To answer your question, Unity's Data Privacy plugin is needed if you've implemented Unity Analytics, IAP, or Ads. So, if you have Analytics implemented, then yes, please also implement the data privacy package. However, developers have not reported to us that the data privacy plugin (or lack thereof) was related to Google's Section 4.8 removals.

Let me know if you have any additional questions.

 

SO if we dont want Ads, Analytics or IAP how can we remove them from Unity to potentially skirt around this issse ?

Or is the Privacy Policy just the blanket way atm to fix this.?

Mine just got pulled 24 hours after being live and it uses GPS and a data connection (its a map based thing) but it has zero IAP, Ads or anything.

 

I just emailed Google for an answer in plane English, if I get a reply ill post it

 

Thanks. Would be very interested in the response....

What I did yesterday:

- I literally went and turned of Unity Analytics as it WAS switched to on.

- Did a rebuild with a new version number and made the .apk

- Uploaded it to Play Console

- Made a privacy policy from the free online tool -https://app-privacy-policy-generator.firebaseapp.com/# and put it on my website and linked to it in the console (but not inside the app although some of the descriptions around what data i use - gps and what i do not are including in the info panel anyway in a nice list)

- Resubmit.

Its back live. Ill see if it last longer than 24 hours......