Unity Analytics and GDPR

Sorry if this has already been asked, but is it possible to just entirely turn off/disable Unity Analytics (ie - from the dashboard) so that we don't have to push out an updated game build with the plugin?

 

Yes would like complete clarification from Unity on this. If you have hardware stats on your build disabled, you turn off analytics and performance reporting via the dashboard, is any data sent out from the app/game at all to Unitys servers?

 

Hello! I'm already use SDK which is require to ask user's permission to track personal data, so i would not like to add another request.
Is there a way to opt-out without visiting URL?
for example, if i call on Start something like:
DataPrivacyUtils.SetOptOutStatus(new OptOutStatus(false, false, true, false, true));
will it be enough?
Thank you.

 

I have the same question. Also, as far I know, Analytics should be disabled until the user gives explicit consent. But with this plugin, Analytics is enabled by default, and won't be disabled until the user clicks on the privacy button, and opt-out. Am I right?

 

I am also confused, I have some games which only uses IAP and I dont want to show any consent page, can I directly disable analytics with this new addon plugin?

 

I wonder if Unity IAPs will work if I set Analytics.enabled = false. Will test soon and let you know

 

it seems to be working ok

 

Did you disable on unity IDE or in code? If it works it will be great.

 

I've tested IAP after disabling Analytics via code, and after disabling it through URL.

 

So disabling via code its enough if we do not want to ahow consent.

 

"Analytics.enabled = false" NOT working for me on 2017.3. Any other ideas or working solutions?

 

All i have tested is IAP working after opt-out from analytics.
I do not know, is it enough to disable Analytics via code or not, maybe there is a URL confirm is needed.
We need to wait official comments from Unity team.

 

What do you mean by "not working"? Is it still sending analytics? Or preventing another service from working as intended (ex: IAP or else)?

Leonid - did you download Unity's plugin for your tests, or did you just set Analytics.enabled = false?

Note that we might not be preventing analytics soon enough by setting Analytics.enabled = false. I think some personal data is sent in the appStart event. I don't know if we can set the flag to false before that is sent.

 

I meant that its still sending stuff to unity at start of the app which I don't want. IAP still works after disabling Analytics at runtime for me

 

Understood, thanks for the clarification. That is indeed unfortunate - it seems like Unity will basically always collect info, and then allow users to opt-out after the fact.

The only "easy" way I could see around this is if disabling analytics for the entire project through Unity website prevents that data from being collected entirely. I don't know if we can do this while other services that rely on it, such as IAP, are enabled.

 

i've downloaded plugin

 

Hi,

I think this system not rely good choice for developers who wants to create their own consent page. I would like to create my own consent page for only NoN-Pers. data and set all third parties via code from single consent page decison. Otherwise many developers will need page after page consent.

 

Unity's legal team representative told me that if you mark the game as for kids, it will make Analytics and other Unity services not to collect personal info and you won't need consent then. So this is one way for now I guess if you don't heavily rely on targeted Unity Ads.

 

So it will be possible to do all this server side without updating the games?

If I go to my analytics dashboard and change the COPAA settings:



And then go to my ads dashboard and do the same:



Will that work? That will be a really good temporal solution until we can update everything. At least a better solution than just un-publish in Europe.

I can't do this with ads because I'm using mediation with a few other networks so I need to update sdks, but for analytics this will be awesome.

Or have the option to just disable analytics completely from the server for a project, that will be the best option but not sure what will happen with IAPs... :S

 

@IvyKun I didn't completely understant this part - "Please note that COPPA designation is permanent and cannot be changed once it is set."
If its permanent - why does it change in dashboard?

 

@mmvlad that's a good question. I didn't try to change it but because of the dropdown behaviour it looks that it can be done... It let me change the value although I didn't click save.



Maybe it doesn't do anything and just keeps the old value? Anyway we don't know if this is the way to go yet.

 

Not what I've heard and that statement contradicts what they wrote here

https://docs.unity3d.com/Manual/UnityAnalyticsCOPPA.html

"In addition to these IDs, Unity Analytics also collects the following personal information from Child App users: IP address, identifiers for advertisers (IDFA is only collected if Unity Ads is also enabled) and device identifiers (IDFV, Android device ID or IMEI if Android device ID is unavailable)."

So a child directed app still collects IP Address, and device identifiers (IDFV, Android device ID or IMEI if Android device ID is unavailable).

 

I have emailed Unity, will post reply here when I get it...

----
There are a lot of questions from developers around consent and analytics to be GDPR compliant.

With the new system from Unity Analytics Privacy SDK, users can opt OUT of data collection but not opt IN. The only mention of consent on the GDPR FAQ is regarding ads, not analytics.

Information on consent required by GDPR for use of personal information
https://ico.org.uk/for-organisation...ion-gdpr/lawful-basis-for-processing/consent/

To me it seems like Unity analytics and this SDK at the moment isn’t GDPR compliant, because you/developers aren’t asking for clear consent being using any personal information.

It would be great for a clear answer from you and your lawyers regarding this and why Unity has gone with opt-out.

Many developers would rather not ask players for consent as the terms can look quite scary to users, what are they doing with my personal data etc. Even if a game is marked for children for COPPA, Unity still collects PII.

To please developers that would like to keep using analytics, but not have to require consent and use PII, why not give an option to anonymise IP address? Google Analytics does this for example.

I imagine you’d rather keep those developers (especially those paying for Pro), than loose the analytics all together.

I appreciate all this GDPR stuff is tricky, but would be grateful if you could answer the above and I will post reply on the forum too.






--
Chris O'Shea

Cowly Owl
www.cowlyowl.com

 

I think all of this stuff should be replied in the forum... it doesn't make sense to send thousands of emails to unity legal team when probably 80% of us will ask very similar questions.

 

I agree, but every reply to anything legal from Unity has told us to email them...

https://forum.unity.com/threads/unity-analytics-and-gdpr.513112/page-3#post-3504976
https://forum.unity.com/threads/unity-analytics-and-gdpr.513112/#post-3476728
https://forum.unity.com/threads/uni...e-now-in-the-asset-store.532484/#post-3506558

They are only answering technical questions on the forum it seems, the tech people don't want to give the wrong legal answer and get them in trouble.

 

Unless there is clarification, I will stop using Unity IAP, and work with other third party IAP provider who does not collect analytic data.

 

I found this page, which let Unity Ads to set consent with manual consent pages
https://unityads.unity3d.com/help/legal/gdpr

We need this style with Unity IAP, we want to create our own consent page.

 

Why I still cannot see the consent request on ads? Does all this start only after May 25, 2018?

 

I made a small utility based on admob solution. With its help you can check if user is in EU region (when there is connection of course).

https://github.com/mmvlad/EuRegionCheckUnity/tree/master

 

With 25 apps to update when you didn't even made them and hired freelancers. It is a difficult task to update them all. May be you need another freelancer to update them. Let me know if I can help you in this matter.

 

Please give me some advice. Where should i put "Opt-out" button in my mobile game according to GDPR rules?
In the Main menu screen or in Settings screen?
Thank you!

 

Unity updated the GDPR page again ¬
https://unity3d.com/legal/gdpr

diff ¬
https://www.diffchecker.com/jNMOKK7g

 

I think the "the nice dev solution" would be ¬

- Inform the user that the game uses Unity Analytics (at app start, first time)
- Inform the user where in the app they can opt-out (opt-out the Unity way that is)
- Implement the opt-out button in an easy accessible menu

 

Appodeal made an example of user content dialog (there's a unity demo to download).
https://blog.appodeal.com/blog/2018/05/08/appodeal-gdpr-guide/

I'm going to use that so the user can opt-in or out of targeted ads and set the flag via code. Not sure if I need to put also the data privacy button or opting in or out in the ads will be enough.

In the plugin it says that the the plugin is unnecessary if you’re using Unity Ads. So if you set the content flag of Unity Ads, the one in that link, I understand that will work too with analytics.

Some confirmation of this will be good, but if it works with the content unity ads show after an ad, it should work with the code version too.

Edit: I saw your reply now in the other thread about not using Uniy Ads.

 

So as result,

I need to implement Unity Ads to disable Unity Analytics for only Using Unity IAP via code. Wow tedious process..

 

When you see what big players like Supercell are doing, justifying absolutely everything under legitimate interest, it's kind of depressing...
http://supercell.com/en/privacy-policy/

 

I just installed Candy Crush to take a look at what they've done and they only have a dialog saying they have updated they privacy policy and that the user need to accept to continue playing. And just a big green accept button.

I thought that was not an option?

Other games I have checked are saying something similar but saying the user can opt-out by going to some link and that they share the data with third-parties to improve advertising etc.

Also instead of giving and opt-out button, like supercell they just put this on text and that's it?

You can opt-out of interest-based advertising on mobile applications by checking the privacy settings of your Android or iOS device and selecting "limit ad tracking" (Apple iOS) or "opt-out of interest based ads" (Android).

I'm not sure this is good for GDPR because the user will opt-out of everything and not just your app, but sure it's an easy and good solution for us.

 

Yeah, no. Definitely not worth it. We're ripping out everything related to Unity services instead. There goes Performance Reporting, there goes Custom Events and the nice things that come with it, all of which have been instrumental in improving the game experience for our premium ad-free PC game. We don't even want IP addresses or any other personally identifiable information. Never have. We just wanted to make the game better. Oh well...

 

I have requested comments by email, and recieved a reply today.
It seems what we can disable Analytics via code. But we also need to hit checkbox "Disable HW statistics" under Player settings - Other settings.
And what is strange - that checkbox is only available with Pro licence.

 

Hopefully there is a patch or update on the way that enables Disable HW Statistics for Unity Personal Edition.

 

Actually, seems like they should just remove HW Statistics reporting.

 

Is this for real? Surely there should be the option to implement Unity IAP that is GDPR compliant out of the box (and only if we want to collect more detailed analytics about the purchase would we need to ask for permission). So I'm guessing that (unfortunately) we should just avoid Unity IAP altogether and buy an IAP plugin from the asset store?

Also, is there not some way of collecting anonymous data that is GDPR compliant, to help tune a game; or is collecting any data without explicit consent illegal?

 

Is something wrong with us ?

We are here 5-10 developers keep discussing GDPR compliance, but nobody else. I also see that most of big developers did not even updated their games / apps ? It is like nobody cares it, but just us..

 

I was thinking the same this morning. I took a look at the top games of the play store to see what kind of dialog they've implemented and to see if they put something in the "What's new" section and only a few have updated. Mainly the big companies, but not all of them or not all of their games...

 

It is illegal to connect to a server outside of the EU without consent because the IP (at least in Germany) is considered as personal data. It does not help if you anonymize unique device identifiers in this case.

You need consent to transfer data outside of the EU. But it looks like Unity is not on the list of privacy shield: https://www.privacyshield.gov/participant_search

„legitimate interest“ – There is no need to send the statistics form a developers point of view. The customer buys the software from the developer, not from Unity. So there is no legitimate interest.

EDIT: It took me a while to understand the concept: This works only if you consider the game as a collection of different components and not as a single product (which it clearly is because we are only licensees of the Unity engine). In this case it would be a legitimate interest of Unity to collect anonymized statistics. I guess thats why the data processing addendum is “controller to controller“ (which I never saw before) and why we need to add the link to Unity’s privacy policy in our privacy policy.

While this sounds a little bit more convincing for me now you should always remember that the GDPR is such a mess that even the Law Society of Düsseldorf, Germany decided to shut down their website. https://www.heise.de/security/meldu...tenkabinett-4057866.html?hg=1&hgi=3&hgf=false

Anyway it would be a nice move to offer “disable HW stats“ as a non-pro option.

 

Ultimately I think Unity should have an appropriate popup automatically appear when the game launches if it has HW Statistics, Analytics, or anything else enabled that requires user consent, much like the permissions popups you get for device permissions (camera, notifications...). This takes the onus off the developers, ensures the consent is given early enough, removes risk for everyone, and makes sense if you think of Unity as a platform (sort of like iOS). Right now we’re going to have a mixture of people who stop using Unity services, people who continue to use them but won’t bother using the privacy plugin, and people who use the privacy plugin but are still at risk of being non-compliant.

 

For those in Unite Europe next month there is a session on June 20th - Breakout 4 - 09:00AM only on GDPR

 

There is no time for people to wait for a month. The lawyers in Germany are starting their cash machines – it is a huge business model here: https://en.wikipedia.org/wiki/Abmahnung (read the last sentence to understand the problem)

 

I just noticed this notice in the Operate section of the Unity Dashboard. It is not as complete as the initial post of this thread, just saying "if you only run Unity Ads" and "if you do not use Unity Ads, but use Unity Analytics", neglecting the case where you use both.