Our Experience w/ an Apple Kids App

Our game is directed at children and has been in the Kids category on the App Store for over five years. We have been using third-party advertising and analytics for several years, but Apple's policy updates caused them to reject our recent build. Apple told us that our build was violating section 1.3 but would not give specifics.

It took 30 days to get our game update approved, with the majority of that time stuck waiting for Apple to respond. We share our experience hoping to help others avoid something similar. Unity was fantastic in assisting us, and it would have taken much longer without their help. Huge thanks to Il Hwan, Rasmuss, Henry, Desse, Shazad, and others

To get the game updated as quickly as possible, we decided to temporarily pull all third-party advertising and analytics. We plan on re-enabling advertising and analytics after the build is approved. We will update this post when we attempt to re-add advertising and analytics.

Here is what we changed to get the build approved.

1. Manually patched DeviceSettings.mm. Because we're using a version of Unity older than 2019.3.4, we needed to manually patch DeviceSettings.mm
2. Removed Unity Ads SDK
3. Removed SuperAwesome Ads SDK
4. Removed Kidoz Ads SDK
5. Removed AppsFlyer SDK
6. Removed Unity TutorialManager plugin
7. Disabled Unity Cloud Diagnostic service in the Services Window
8. Upgraded Unity IAP to version 1.23.4 to get this fix:SystemInfo.deviceUniqueIdentifier collection and sharing with ecommerce.iap.unity3d.com server
9. Disabled Unity Analytics at runtime. Because we use Unity IAP, UA must be disabled at runtime (instead of in the Services Window). We accomplished this by attaching the following script to a GameObject in the startup Scene:

Code (CSharp):

1. using UnityEngine.Analytics;
2. using UnityEngine;
3.  
4. public class UnityAnalyticsDisabler : MonoBehaviour
5. {
6.     // Disables analytics before any code runs that sends analytic events
7.     [RuntimeInitializeOnLoadMethod(RuntimeInitializeLoadType.BeforeSceneLoad)]
8.     public static void OnRuntimeMethodBeforeSceneLoad()
9.     {
10.         Analytics.enabled = false;
11.         Analytics.deviceStatsEnabled = false;
12.         Analytics.initializeOnStartup = false;
13.         Analytics.limitUserTracking = true;
14.         PerformanceReporting.enabled = false;
15.     }
16. }

We used Charles to inspect our game's traffic, allowing us to find all third-party plugins and SDKs that sent network calls.

After making the above code/config changes, our build was rejected two more times due to Apple's incompetence or misunderstanding. We answered No to all the questions about advertising and analytics, repeated all the answers in the review notes, and Apple still failed the build by asking if we use advertising and analytics.

8 days after replying to the in the Resolution Center telling them (for the fourth time) that the game does not have advertising and analytics, we got a phone call from Apple, finally approving the build. The Apple representative told us we "did everything right" but there was a misunderstanding on their side that took them 2.5 weeks to figure out.

Thanks again to the Unity team for being available and interested in helping. If only every company cared about its developers as Unity does. <3

 

We removed UnityEngine.Analytics and all other Analytics features.Apple still rejected us.
Then we had a phone call, and apple tech look into our code. Some days later, apple told us some problems in unity, ask us to contact unity official to resolve it.
I am sure we removed all maybe against guideline 1.3.
Do you mean we should try summit app for apple review?

 

Can you elaborate on the "some problems in Unity"? And I don't follow "I am sure we removed all maybe against guideline 1.3" thanks

 

Which third party stuff are you using? In my case Apples was throwing the issues into Unity, but in the end it was Firebase who was including those Unity APIs in the build (and removing Firebase completely solved for me)

 

First of all, we do Not use Firebase. the third part framework we use, I check them all with the code "grep -r advertisingIdentifier" , and make sure they don't contain advertising and tracking, they are all base tools.
"grep -r advertisingIdentifier" shows some string in unity files.
After I tried solutions from the forum, and all rejected. I request a phone call support from apple.
Then apple called me, I told him what I have done, and ask him how to resolve this. He told me maybe they misunderstanded our app, he will let tech engineer look into the app. At last he called me again, they still found advertising identifier or tracking in unity. I said I have delete all code about ad or tracking, but I can not do anything with unity source code. Then he said I should ask Unity3d official for some help. That is all.
It seems in a infinite loop...

 

Hello! We have AppsFlayer and Firebase Crashlytics stuff in our kids project, but was approved for the AppStore. Also we did nothing with patching DeviceSettings.mm file.

From my point of view, there are only two main things:
1. Don't use Unity services, just keep it turned off, so nothing will be needed to be fixed or patched.
2. Ask your company lawyer for help. Yeah, it is a surprise suppose We created nice Privacy Policy and Terms Of Use documents with explanations about using different analytics stuff, and it worked.

 

I modify the DeviceSetting,mm file. And remove Unity Analytics service. Do you mean not removing it, only disable it, make it 'false'?

 

If you don't use Analytics, you don't need to disable it. You can confirm what your app is sending by using Charles Proxy, it's invaluable to troubleshoot these types of issues https://support.unity3d.com/hc/en-us/articles/115002917683-Using-Charles-Proxy-with-Unity

 

I have used Charles Proxy, and no request connect to unity3d.com or unity.com.
The most requests' host is our own server. Because we use IAP, apple.com is also a host.
Nothing maybe about analytics is shown.

 

Share your capture here, or send it in a private message. They may also be inspecting the binary itself and not necessarily looking at the runtime behavior, we are still trying to find out.

 

I’ve disabled it in the Services window and removed all relative packages about ads/iap and etc. And that’s all. Charles Proxy doesn’t solve the issue, Apple doesn’t like Unity Analytics libraries, not the internet traffic.

Also I’m really serious about powerful EULA/Privacy docs. We referenced to these guys to substantiate AppsFlyer analytics using and any other stuff Apple can find.

We have been consulted with different kids apps developers, they also solve this issue with EULA/Privacy. You even can use Unity Analytics/Unity IAP too.

I must note that the human factor also plays a role.

 

update: attached file 'charles.png' is a capture of Charles for about 1 minute running.
red rects are our server domain, ip addresses are our server supplier's.
-------------------
I uploaded 2 images below.
'screenshot1' is the Charles screenshot. They are during starting app and running for several minutes.
red rect is our own server domain

'screenshot2' is a screenshot after I run the command to scan my source code.
grep -r advertisingIdentifier . try to find some code match 'advertisingIdentifier'

Please look into them, maybe give me some ideas.
Our app was rejected again yesterday. Still the same reason.

 

@restauranttttt Please attach your Charles capture

 

I have updated my last post with a new Charles capture. Is it correct?
Anything other I can provide for you ?

 

You are correct, your app is not contacting any Unity servers.

 

Would it be possible to get a hint on what should be in the EULA/Privacy to get approved? We have payed a service to create our EULA/Privacy to comply with Apple guidelines but still get rejected for this reason. Here are our Terms and Conditions and EULA in case you want/can check:

https://www.twinforce.es/en/terms-and-conditions
https://grunt.twinforce.es/

 

Ours:
https://magickids.me/privacy
https://magickids.me/terms

And there is an example how we answer Apple's standard questions (I send this note with every build)

Spoiler

We know that you will have the next questions:

• Does your app include third-party analytics?
Yes, but just to create a GREAT user experience under the privacy policy. For example we collect: Game access status, Subscription Information (ID, Order ID, Renewal Status, Start and Till dates, Price, Status, Currency and Cancellation reason) Cancellation reason, Marketing campaign type, Application media source, Product ID and Language.
We use this information for understanding and analyzing trends in connection with the usage of our services, gathering demographic information about our user base, data about where applications were downloaded from.
We may also create reports and analyses for the purposes of research or business intelligence, for example to track potential problems or trends with our applications and services, or to test our new game features and content.
Please check this in our privacy policy which we created together with US lawyers from New York: magickids.me/privacy

• Does your app include third-party advertising?
No.

• Will the data be shared with any third parties?
No.

• Is your app collecting any user or device data for purposes beyond third-party analytics or third-party advertising?
No.

So, we have NO Unity Analytics, IAP and Ads packages, but still using AppsFlyer and Crashlytics. I've added Voxel IAP asset for purchases and implemented Firebase back-end for receipt validation.

P.S. I'm shocked Unity and Apple still have no easy decision for developers. However we were told that using Unity's stuff is possible with the help of the documents above, but I can't confirm this personally.

 

Thank you so very much! Will give a try and see what's different with ours docs and see to add info if something is missing.

 

Hello,

I have a small question about Unity Analytics / iOS for kids apps. Since January we deactivated Unity Analytics manually in Unity and with the manual xcode modifications (and we get approved without any issues). We use the IAP Unity package.

Although, we do have some Unity custom events in our project that we can only run on Android devices. Is there currently any way to reactive the Unity Analytics for iOS (and not track the device identifiers so Apple allows it)?.

We do use Remote Settings, Funnels and A/B Testings for improving using experience and it would really help us to track apple's users (with no personal data involved). Also, so we could track MAU unifying Android and iOS users. Is that possible?

Thank you very much for your help,

 

You could use #IFDEF conditionals to execute code for Android only, see IAPDemo.cs for examples.

 

This is the probably THE worst problem i had since i start developing in unity. We been rejected more then 10 times. We had two calls with apple representives and still nothing. We now are appealing to the board just because we cant turn off unity analytics. We did every step you suggested. We use unity 2019.4.9f, we put in every scene your scripts for disabling and still we are getting rejected.
We love unity IAP so we wouldnt want to use something else but how it turns out we would need to use some third plugin. But this is ridiculous that we are failing because we cant remove fully UNITY analytics from app cause its merged with unity iaps.

@JeffDUnity3D any idea when will you release seperated unity analytics and unity iaps plugins?

 

Please share a Charles capture to confirm that it is indeed Unity Analytics and/or IAP sending any data https://support.unity.com/hc/en-us/articles/115002917683-Using-Charles-Proxy-with-Unity Also, share the code that you have in Start() and/or Awake() that disables Analytics at runtime. To your question, it's a few months out.

 

Hi @JeffDUnity3D, thanks for helping it has been so frustrating to communicate with apple that we dont use analytics in any kind. I think that they are finding plugins inside the build and they are not letting go this problem. Here is my charles screenshot. As you can see, we are calling only apple links when I open app, probably for the purchasing.

Code is this. It has been copied exactly as above(thank you @wwcolter ) and put in script and attached to objects in every scene.

Code (CSharp):

1. using UnityEngine.Analytics;
2. using UnityEngine;
3. public class UnityAnalyticsDisabler : MonoBehaviour
4. {
5.     // Disables analytics before any code runs that sends analytic events
6.     [RuntimeInitializeOnLoadMethod(RuntimeInitializeLoadType.BeforeSceneLoad)]
7.     public static void OnRuntimeMethodBeforeSceneLoad()
8.     {
9.         Analytics.enabled = false;
10.         Analytics.deviceStatsEnabled = false;
11.         Analytics.initializeOnStartup = false;
12.         Analytics.limitUserTracking = true;
13.         PerformanceReporting.enabled = false;
14.     }
15. }

Any help would be much appreciated, but I think this is now Apple good will if they will let us go.

Also we did that manual fix DeviceSettings.mm even if we are using unity where that has been fixed.

Like I said, its probably because they are finding Unity analytics package inside build.

I will update you how the appeal goes. Wish us luck

 

@skrpeta Correct, you are not sending any data! The only network requests are going to Apple, as you point out. You might want to show this to Apple, if you haven't already.

 

@JeffDUnity3D thank you. We'll try to submit this.

 

We're now getting repeat rejections on a kids app that had previously gone through successfully.
We had numerous successful updates from late July, when Unity fixes were released to allow us to stop analytics calls - but keep getting rejected as of this week. Not sure if this means Apple have moved the goal posts again.
Be interesting to know if @skrpeta has success.

 

I would suggest that you also obtain a Charles Proxy capture to present to Apple.

 

Hi there, just had the following from Apple :-

"We continue to find that your app is using IDFA, which can be used to collect personally identifiable information. To resolve this issue, please remove this functionality or revise your app so that no personally identifiable information or device information is sent to third parties."

I've asked for clarification regarding how they have concluded our app is using IDFA (i.e. via code inspection or monitoring calls via Charles Proxy or similar). I didn't check Charles Proxy on the most recent release - but had done on an earlier release that showed everything was clean (and haven't knowingly changed anything that would have affected this). Wondering if they're now doing it via code inspection.

 

That is our suspicion, they are inspecting the binary. Ensure you are using an up-to-date version of Unity https://support.unity.com/hc/en-us/...entifier-selectors-from-the-Unity-SDK-on-iOS- Update - I've heard of similar reports of users still seeing this issue with recent versions of Unity too. Apple just posted this https://developer.apple.com/app-store/app-privacy-details/

 

Thanks - I'll update if/when I get more info from Apple to corroborate this.
I'm using a fairly up to date version of Unity - I think this was built using 2019.4.1f1.
But there's something they're not happy with now (that was acceptable in several successful releases in the last few months).

 

@Jonsi After waiting for about a week after we submited our appeal this is the message we receveid from apple.
"After further review, we have determined that the app is still in violation of guideline 1.3.0.

In order to comply with this guideline, it would be appropriate to remove any code which blocks unity analytics. In addition, the IDFA needs to be completely removed."

So this was a bad week for us. We unfortunately need to remove unity IAP from our app to remove unity analytics. Which is ridicilous but thats what it is. Also we dont get this part "the IDFA needs to be completely removed" cause we thought with new versions of unity this is not a problem. As we never used any ads in our app.

So this is conclusion of our problem with apple guideline 1.3.0. We will probably use some other iap plugin, prime31 is one of options but kinda pricey. Any other good plugin for iaps that is working for both google and ios at the same time?

 

@skrpeta Many thanks for the update - I'm waiting for a call from Apple (3-5 working days). At least I know what to expect now.

@JeffDUnity3D we really need a fix for this issue with Unity IAP for iOS kids category apps. Any view as to when this is likely to be delivered? I know last time you resolved it impressively quickly. Seems like there's a problem with Apple finding IDFA and with Unity analytics being present - can Unity get any more clarification from Apple on this?

 

There is no issue with IAP. You can turn off Analytics at runtime, so that's not the issue either. They seem to be inspecting the binary and finding other evidence.

 

@JeffDUnity3D Yes I agree. I think they're inspecting the binary and finding IDFA - but I think this is only in the binary in this case because it is all tied in with Unity IAP? I may be completely wrong on this though - you guys will know better.
It may be connected with this question one gets from Apple https://forum.unity.com/threads/does-unity-iap-or-analytics-use-idfa.822813/ - i.e. they now are deciding IDFA is there and therefore rejecting the binary.
This seems to be a new thing - I've had several releases go through in the last few months. Still waiting for Apple to call me - I'll try and get as much info as possible.

 

Sorry no, it's not being found in IAP or Analytics, those products don't use nor reference the IDFA

 

Thanks! Very useful to know - at least we don't have to rip out Unity IAP (great news).

Has it ever been in Unity IAP? Is it just a question of using a newer version?

Or is it in Unity elsewhere then? I've not knowingly got Unity Ads included - which is presumably where else it may be. How could I track it down?

 

Correct, it's never been in Unity IAP. It's not clear where Apple is finding it at this time. Have you checked the LinkMap file https://forum.unity.com/threads/che...ted-for-using-advertisingidentifier-a.966841/

 

Thanks. And just to be absolutely sure, when you say it's never been in Unity IAP - does this also mean it's never been in Unity Analytics either (which is currently a dependency when using Unity IAP).

I'll look at the LinkMap - looks slightly complicated so may take a little while.

Thanks again for your help - I'm always impressed by your engagement on these forums!

 

Correct the IDFA has never been in Analytics. The IDFA is not used by Analytics, it's used with advertising.

 

Thanks - good to clear that up.

I was asking because looking at https://docs.unity3d.com/Manual/UnityAnalyticsCOPPA.html when talking about Analytics it says :

"IDFA is only collected if Unity Ads is also enabled"

so I thought the code in the Analytics package could possibly still be referencing IDFA even if is not actually used unless Ads are activated.

Anyhow - good that this isn't the case. Thanks!

 

@skrpeta Just tagging you on this to alert you to the comments regarding the IDFA problem not being in UnityIAP/Analytics and how to try and identify where the issue is in a build (using LinkMap).

 

@Jonsi Short update: We removed unity analytics and with that unity IAPs from project. We went with prime31 storekit plugin for IAPS.
Also I noticed that we had unity advertisment package inside our project in Packages menu. I never installed it myselft as we never used ads in our apps, so that was probably problem with IDFA. Removed it also.

Short story we passed immidiatelly review without any problems. And thats that. I hope that unity will try to fix this in future updates, as we liked unity iap plugin and we still use it on android builds.

 

@skrpeta Thanks for the update! Helpful to know (and gives us hope).
I found the unity advertisement package inside our project too, I didn't knowingly include it. Like you, we don't use ads so I'm not sure how it slipped in. Anyhow we've removed it and our LinkMap looks good now so we're trying another submission with Unity IAP (and therefore analytics). If this still doesn't work we'll go with a 3rd party asset like you have.

 

@skrpeta just for info, our app went through review with Unity IAP (with analytics in there - but switched off). I'm thinking that it was probably the presence of the Unity Ad package in my project (which I wasn't using) that tripped my submission up (it was present in several previous builds that got through OK - but shouldn't have been in there anyway).
Thanks again to @JeffDUnity3D for the help and link to LinkMap instructions!

 

Hi there!
Our small team has been working on a kids app for a month, we have a concept now, so now we read technical manuals and guides on all the peculiarities regarding working with App Store, so your post is really very useful for us, thank you for sharing your experience!

 

This may also help https://unityads.unity3d.com/help/ios/apple-privacy-survey

 

Hello,

I have added the `UnityAnalyticsDisabler` class as explained above (no need to modify DeviceSettings.mm because we use a recent version of IAP).

In charles proxy (see screenshot in attachement) we can see there are no calls to config.uca.cloud.unity3d.com and cdp.cloud.unity3d.com but there are still some calls to perf-events.cloud.unity3d.com.

I tried to submit the app anyway but got rejected again.

It is not 100% reproduceable but calls to perf-events.cloud.unity3d.com happen mostly in the following cases:

• App is sent to background (or when displaying all opened app in a mozaïc)
• App is brought back from background
• First user interaction after app is brought back from background
• First call to Addressables.LoadSceneAsync(projectId, loadMode: LoadSceneMode.Single)

Unity version: 2019.4.8f1
IAP version: 2.2.2

How can I block calls to perf-events.cloud.unity3d.com ?

 

Are you using Crash Diagnostics? That is the service that hits that endpoint.

 

@JeffDUnity3D thanks a lot. In the configuration of "Cloud diagnostics" one can disable "Crashes and exceptions" and which makes the app stop communicating with perf-events.cloud.unity3d.

I just resubmitted the app, I'll let you know how it goes this time.

 

Some updates that might be useful to others:

The app was rejected again with the following message from apple

"Specifically, we found that your app references the ASIdentifierManager API, which provides access to a user's IDFA, in the following location(s) in your binary:

• Frameworks/UnityFramework.framework/UnityFramework

To resolve this issue, it would be appropriate to remove all instances of “ASIdentifierManager” from your app, even if they are not utilized in your app's functionality."

I had already deactivated the ads services and checked what was displayed in the package manager but somehow unity Ads was sticking around in ./Library/PackageCache/com.unity.ads@3.4.7.
So I deleted the folder from the file explorer, rebuilt the iOS app.

Just to be sure I used the discussion about IDFA (https://forum.unity.com/threads/che...ted-for-using-advertisingidentifier-a.966841/) to check that the project was now clean.

I'll let you guys know how it goes this time