Google play Violation of Advertising ID

This is still an issue 2019.1.4f1. I just had an app rejected. I filed a bug report (for all the good it will do). My app has no interactions at all, it is a simple piece of virtual art. I was using a time honored practice of building release in a fresh install, and virgin project.
The problem I have is that The dependency manager should remove all code that is not being used in an app. In other words, release builds are not "release" and still have untested, & unused code. creating opportunities for security violations, & trojan. Google, or Apple could simply decide one day that all apps made with Unity are a security risk and take 'em all down.
and for posterity:
------------------------
Hi developers at Smooth Curves Interactive,

After review, Diagnosis, com.SmoothCurvesInteractive.DiagnosisVR, has been removed from Google Play due to a policy violation. This app won’t be available to users until you submit a compliant update.

Issue: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement

Google Play requires developers to provide a valid privacy policy when the app requests or handles sensitive user or device information. We’ve identified that your app collects and transmits the Android advertising identifier, which is subject to a privacy policy requirement. If your app collects the Android advertising ID, you must provide a valid privacy policy in both the designated field in the Play Console, and from within the app.

Next steps: Submit your app for another review

1. Read through the Usage of Android Advertising ID and User Data policies, as well as the Developer Distribution Agreement, and make appropriate changes to your app. If you decide to collect sensitive user information, be sure to abide by the above policies, and include a link to a valid privacy policy on your app's store listing page and within your app.
2. Make sure that your app is compliant with all other Developer Program Policies. Additional enforcement could occur if there are further policy violations.
3. Sign in to your Play Console and submit the update to your app.

Alternatively, you may opt-out of this requirement by removing any requests for sensitive permissions or user data.

If approved, your app will again be available with all installs, ratings, and reviews intact.

If you’ve reviewed the policy and feel this removal may have been in error, please reach out to our policy support team. One of my colleagues will get back to you within 2 business days.

Thanks for helping us provide a clear and transparent experience for Google Play users.


Regards,



The Google Play Team

--------------------------------------------

 

Two days ago one of my apps got removed due to the same violation, that game was made with Unity5.5. I had to reinstall 5.5 in order to open my game correctly. My game never collects any data, or needs any special permission or access at all, and I deleted anything that's not essential to the gameplay, resumbitted the app to Google Play. A day later, I got an email saying my app has been reviewed and approved. I was relief, even though I have no clue what the problem really was.

But happiness did not last. Two hours later another app of mine got removed, I got the same violation email from Google. And then several hours later, the previous re-approved app is removed again, and I once again received that exact same email. This is frustrating, does not make any sense. If there is a war currently between Google and Unity, please do tell, I mean.. seriously, my games have been on Google Play for years, and now they are kicking us out like this.

 

This is bad. It feels like having a huge sword of Damocles on your head. What if an old client's application get removed and he thinks its your fault and wants you to do all this updating for free after years? It's getting ridicolus and extremely unprofessional.

 

Same here, got a 2-5M downloads app with 4.7 rating removed with NO warning at all.
"Issue: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement"

Free, no ads, nothing. On-request GPS anonymous tracking for unlocking extra features when nearby certain areas.

My guess is that before publishing someone enabled back the Crashlytics module and analytics as per test builds. Yet, no "sensible" info got collected during playtest, only anonymous data to track play time, scene changes, interactions, etc.

Could it be the reason, @JeffDUnity3D?

Now the company is panicking since, in turn, it is a client for a public national structure.

Any clue?

 

Hello all, I wanted to update you all on a solution that worked for me, and has continued to work so far.

My app was removed from the Google Play Store for similar problems and violations as you all have seen, and I have come across a solution that works because I have no ads, I do not monetize the app using ads, and I do not use Unity Analytics in the app whatsoever.

I did NOT include a privacy statement because I no longer need one, since I am not collecting any data at all. No analytics, no ads, no data collection of any kind.

After doing quite a bit of research, it appears that my problem was that Unity Analytics was collecting and sending basic device information in the background of my program. Some users have said that the best way to prevent this was to purchase the Premium version of Unity to shut this feature off, but many other users have said they have gotten limited success from it.

What I've done is disable hardware statistics in player settings, modify the Unity Connect Settings asset, and attempt to deactivate analytics at run time. I realize that it is very likely that these steps are redundant, and maybe even optional, but I really wanted to make sure this problem didn't cause me to have my apps removed in the future.

These are the steps I've taken:


Disable Hardware Statistics in Player Settings:

Purpose: I am attempting to prevent Unity from collecting information about the devices it's being used on, and sending that to Unity servers, which would require me to create a privacy statement.

• In Unity, in the toolbar, go to File > Build Settings
• In the Build Settings window, in the lower left-hand corner, click the "Player Settings..." button
• The Inspector will open displaying the Player Settings
• Select the "Android settings" tab in the Player Settings window if it has not already been selected
• Select the "Other Settings" drop down
• Under "Configuration", select the "Disable HW Statistics" checkbox, and make sure it is checked

Manually Edit the Unity Connect Settings Asset.

Purpose: I am attempting to force Unity not to initialize Unity Analytics at start up. Creating a privacy policy and an opt-out interrogative feature would be cumbersome and unnecessary.

• Build your Unity Project
• Once it has finished building, leave Unity open and do not close Unity
• Enter into your file hierarchy (for example, this would be opening up Windows Explorer)
• In your file hierarchy, navigate to the project location where your Unity project is saved.
  • This was defined by you when you first created the app.
  • The folder should be named after your project.
  • When you are in the correct folder you will see folders like "Assets", "Library", "Packages", "Logs", etc.
• In the project location, open the "ProjectSettings" folder
• Open the UnityConnectSettings.asset file
• Change the following settings in the file, some items left intentionally blank:

CrashReportingSettings:

m_EventUrl:​

UnityPurchasingSettings:

m_Enabled: 0
m_TestMode: 0​

UnityAnalyticsSettings:

m_Enabled: 0
m_TestMode: 0
m_InitializeOnStartup: 0​

UnityAdsSettings:

m_Enabled: 0

m_InitializeOnStartup: 0
m_TestMode: 0
m_IosGameId: 0
m_AndroidGameID: 0
m_GameIds:

AndroidPlayer: 0
iPhonePlayer: 0
tvOSPlayer: 0​

m_GameId: 0​

PerformanceReportingSettings:

m_Enabled: 0​

• Save the file
• You may close Unity at your leisure.

Disable all analytics at run-time:

Purpose: I am attempting to prevent Unity from changing some of the previous connection settings during run time due to background process that are beyond my control.

• Create a method which will be accessed at startup
  • I personally created a class which has a static method that is executed at the start up of any scene.
• Write the following method:
• Code (CSharp):

  1. public static void disableAnylitics()
  2.     {
  3.         UnityEngine.Analytics.Analytics.enabled = false;
  4.         UnityEngine.Analytics.Analytics.deviceStatsEnabled = false;
  5.         UnityEngine.Analytics.Analytics.initializeOnStartup = false;
  6.         UnityEngine.Analytics.Analytics.limitUserTracking = false;
  7.         UnityEngine.Analytics.PerformanceReporting.enabled = false;
  8.     }
• In the event that Unity changed some of these values to true, re-setting them immediately will hopefully turn Unity Analytics off and prevent unwanted data collection

If you read this suggestion, let me, and everyone else in the thread, know how it went. Again, it's worked for me so far, but I do not have any ad or analytics features in my app. It's been a month since I uploaded the newest version, and I've yet to get a complaint or violation from the store.

 

I had a similar problem to you, NeatWolf. I was able to work out that it was definitely Unity Analytics sending some kind of data (I think hardware data) to Unity. Google Play wants that covered in a privacy document, but because I didn't want to make a privacy document, I figure out how to disable it. It's not too involved, and it's probably a little redundant, but I've had no issues with Google Play for the past month. I have no privacy statement either, which suggests that I truly may have fixed it.

I listed my steps here: https://forum.unity.com/threads/google-play-violation-of-advertising-id.558010/page-2#post-4692782

 

Bbkyrs, I think I found a solution. I posted in the thread, here

 

@EpsilonSE Your steps are correct. To confirm, you would want to run Charles Proxy to confirm what is being sent https://support.unity3d.com/hc/en-us/articles/115002917683-Using-Charles-Proxy-with-Unity

 

The steps are correct?

Can you please add sane defaults? Why is m_InitializeOnStartup: 1 for ads and analytics when I use neither ads nor analytics?

Can we please have a simple "UNITY PLEASE DON'T SEND ANY STUFF" checkbox that actually works somewhere, instead of the current "Please check 10 different menus (because some settings enable themselves back on from time to time), edit a bunch of files manually, do a rain dance AND THEN STILL NOT BE SURE"

 

Sorry for the late reply. I'll try that, and get back to you on that by the end of today or tomorrow. I've never used Charles Proxy before.

 

Okay, it may sound stupid, but how can I open it, since it's a binary file?..

 

It’s not binary

 

Read this or that.

Didn't that help you?

 

It's ascii for me. Maybe it depends on the Asset serialisation mode : https://docs.unity3d.com/Manual/class-EditorManager.html

 

Yes, I've googled that myself, but still thanks!

 

@EpsilonSE solution didn't help, my game still got removed from Google Play with the same reason:

 

I received the same message from Google and putting in a privacy policy in the Google developer dashboard (and in the app) fixed it for me, so far anyway. Did you implement a privacy policy before resubmitting?

 

I understand that it can fix my problem, but why should I do it, if I do not collect any data?

 

Did you confirm with Charles Proxy ?

 

I mean, I myself did nothing to collect it. I payed hell a lot of money for Unity licences and I honestly do not understand why it does something that I can not control and moreover something that brings loss to me. And when I'm here like seriously guys, just disable this, all I'm getting is the advice to implement some privacy policy that I'm obviously do not need and that will certainly mislead my users. GG.

 

It would be good to confirm before drawing conclusions. If you have ANY Unity services enabled, data will likely be sent. And you can control it, if so.

 

Well, I don't.

 

Understood, a Charles capture would confirm.

 

Yes, it does... something. Here are the logs:
http://www.mediafire.com/file/okk5koflzwkcqu6/Untitled2.chls/file
http://www.mediafire.com/file/hbtl6lhcd7ndjki/Untitled.chls/file

 

That means some services are enabled. If you install the Charles Root Certificate (Help/SSL Proxying/Install Charles Root Certificate) and REBOOT, it should remove those red x's and you'll see exactly which service(s).

 

I did that right away. Now I reinstalled it, and did a several reboots - they are still red.

 

Oh sorry, under SSL Proxy settings, you need to set *.unity3d.com:* There is more info here: https://support.unity3d.com/hc/en-us/articles/115002917683-Using-Charles-Proxy-with-Unity

 

Yes, I did everything just like this guide suggests, but it's still "unknown>"

Same.

 

Maybe that's it?

https://cdp.cloud.unity3d.com
https://config.uca.cloud.unity3d.com


inb4

 

As long as you rebooted and followed the steps in the link it should work as expected. I'm not aware of any SSL issues at our end, but it's possible. You can also check your UnityConnectSettings.asset file under /ProjectSettings.

 

I did everything according to the guide above on this page, and this file hasn't been modified since.

Are these not the resources you are looking for?

Spoiler: ___

 

@Dreamtale Sorry, I don't quite follow. I believe you forgot to include the contents of the UnityConnectSettings.asset file in your reply? The contents will also tell which services are enabled. We send several types of service requests to those endpoints, and would be good to know which services are enabled. Also, ensure HW Stats is not enabled.

 

No I didn't. Though, @EpsilonSE forgot to mention that you need to disable crash reporting:

  CrashReportingSettings:

    m_EventUrl:

    m_Enabled: 0

Now my game doesn't send anything (it seems at least). Another matter why does Unity transmit Google advertisment ID in crash reporting? Or why Google thinks Unity does...

(The game still doesn't work, but that's another thing.)

 

Yep, all services. And it seems to be a canned message from Google.

 

I'm also having this issue on a SIMPLE game I published yesterday!

@JeffDUnity3D - this is really an unacceptable state of affairs from UNITY. You guys need to get onto a solution ASAP because I don't want to have to do a S*** ton of additional work and manual file editing so I can get a Unity app to actually work on the Play Store.

Sort it out!!!!!!

 

https://issuetracker.unity3d.com/is...the-ads-slash-analytics-services-are-disabled
Status of the bug is:


So which is it? Is it not reproducible, is it fixed, or is it planned?

Are he privacy related checkboxes in Unity just for show?

 

@JeffDUnity3D ... In case there are no ads, IAP, Analytics, nothing ... What about GDRP? Do you have to be detailed in the privacy policy?
The generator of "https://app-privacy-policy-generator.firebaseapp.com/" does not generate the section for GDRP.
What does a privacy policy have to include for a game that has no ads, IAP, Analytics, etc.?
Thanks.

 

There is contact information at the bottom of this page https://unity3d.com/legal/gdpr

 

So in my privacy policy do I have to add the link "https://unity3d.com/legal/gdpr"?

 

No, it was included for your review for additional information on GDPR.

 

Sorry, but I do not understand.
If the game has no Ads, IAP, Analytics, nothing ... should something like this be added to the privacy policy ?:

"Your Data Protection Rights under the General Data Protection Regulation (GDPR)
If you are a resident of the European Economic Area (EEA), you have certain data protection rights. XXXX aims to take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Data.

If you wish to be informed about what Personal Data we hold about you and if you want it to be removed from our systems, please contact us.

In certain circumstances, you have the following data protection rights:

The right to access, update or delete the information we have on you.Whenever made possible, you can access, update or request deletion of your Personal Data directly within your account settings section. If you are unable to perform these actions yourself, please contact us to assist you.

The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.

The right to object. You have the right to object to our processing of your Personal Data.

The right of restriction. You have the right to request that we restrict the processing of your personal information.

The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.

The right to withdraw consent. You also have the right to withdraw your consent at any time where XXXX Limited relied on your consent to process your personal information.

Please note that we may ask you to verify your identity before responding to such requests.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the European Economic Area (EEA)"

Thanks.

 

If you have questions on GDPR, I provided a link to the information and an email address for more information.

 

We added something along the lines of:
We disabled all data collection from Unity we could, but we cannot guarantee that no data collection happens from Unity and from our understanding of their privacy policy some data collection happens no matter what we do (and that goes for all Unity games).
You can read their privacy policy here: Unity Privacy Policy (the relevant part is "I play a game built with Unity software, what should I know?")

 

If anyone have this problem yet, i found the solution.

 

It's very frustrating that I have to remove the Unity Services from my game since all I want is to use IAP but no Analytics. Going to seek other solution since everything I tried from this forum didn't work.

 

Understood on your concerns, we are investigating. We are currently quite resource constrained so it may take some time, apologies on the delay.

 

I thought they made it so IAP requires Unity Services.

 

Yes, IAP requires Analytics currently.

 

Can you please make an API to turn off ID collection? I think you guys made a web interface for users to opt-out but it's really ugly & clunky to use. A simple line of code should do the job.