Search Unity

Unity Analytics and GDPR

Discussion in 'Unity Analytics' started by wwcolter, Jan 17, 2018.

  1. ap-unity

    ap-unity

    Unity Technologies

    Joined:
    Aug 3, 2016
    Posts:
    1,258
    The Data Privacy plug-in has been released on the Asset Store:
    https://forum.unity.com/threads/uni...g-in-available-now-in-the-asset-store.532484/

    If you use both Unity Ads and Analytics, the opt-out mechanism provided by Unity Ads applies to both services. If you do not use Unity Ads, but do use other Unity services, such as Unity Analytics, IAP, Multiplayer, or Performance Reporting, then you must use the Unity Analytics Data Privacy plugin to provide an opt-out choice to your players.

    If you have any questions regarding GDPR, please contact DPO@unity3d.com.

    If you have any issues with the plugin, please let us know.
     
    Shawn_Flanagan likes this.
  2. noethis

    noethis

    Joined:
    Nov 11, 2013
    Posts:
    105
    Sorry if this has already been asked, but is it possible to just entirely turn off/disable Unity Analytics (ie - from the dashboard) so that we don't have to push out an updated game build with the plugin?
     
    spacepluk and Leonid like this.
  3. coshea

    coshea

    Joined:
    Dec 20, 2012
    Posts:
    252
    Yes would like complete clarification from Unity on this. If you have hardware stats on your build disabled, you turn off analytics and performance reporting via the dashboard, is any data sent out from the app/game at all to Unitys servers?
     
    MoribitoMT and Leonid like this.
  4. Leonid

    Leonid

    Joined:
    Aug 20, 2013
    Posts:
    35
    Hello! I'm already use SDK which is require to ask user's permission to track personal data, so i would not like to add another request.
    Is there a way to opt-out without visiting URL?
    for example, if i call on Start something like:
    DataPrivacyUtils.SetOptOutStatus(new OptOutStatus(false, false, true, false, true));
    will it be enough?
    Thank you.
     
    Last edited: May 22, 2018
    pep_dj likes this.
  5. pep_dj

    pep_dj

    Joined:
    Nov 7, 2014
    Posts:
    154
    I have the same question. Also, as far I know, Analytics should be disabled until the user gives explicit consent. But with this plugin, Analytics is enabled by default, and won't be disabled until the user clicks on the privacy button, and opt-out. Am I right?
     
    Leonid likes this.
  6. MoribitoMT

    MoribitoMT

    Joined:
    Jun 1, 2013
    Posts:
    294
    I am also confused, I have some games which only uses IAP and I dont want to show any consent page, can I directly disable analytics with this new addon plugin?
     
  7. mmvlad

    mmvlad

    Joined:
    Dec 31, 2014
    Posts:
    85
    I wonder if Unity IAPs will work if I set Analytics.enabled = false. Will test soon and let you know
     
  8. Leonid

    Leonid

    Joined:
    Aug 20, 2013
    Posts:
    35
    it seems to be working ok
     
    spacepluk and MoribitoMT like this.
  9. MoribitoMT

    MoribitoMT

    Joined:
    Jun 1, 2013
    Posts:
    294
    Did you disable on unity IDE or in code? If it works it will be great.
     
  10. Leonid

    Leonid

    Joined:
    Aug 20, 2013
    Posts:
    35
    I've tested IAP after disabling Analytics via code, and after disabling it through URL.
     
  11. MoribitoMT

    MoribitoMT

    Joined:
    Jun 1, 2013
    Posts:
    294
    So disabling via code its enough if we do not want to ahow consent.
     
  12. Basti_TinyRoar

    Basti_TinyRoar

    Joined:
    Oct 4, 2016
    Posts:
    3
    "Analytics.enabled = false" NOT working for me on 2017.3. Any other ideas or working solutions?
     
    Last edited: May 22, 2018
    MoribitoMT likes this.
  13. Leonid

    Leonid

    Joined:
    Aug 20, 2013
    Posts:
    35
    All i have tested is IAP working after opt-out from analytics.
    I do not know, is it enough to disable Analytics via code or not, maybe there is a URL confirm is needed.
    We need to wait official comments from Unity team.
     
    sandbaydev likes this.
  14. Swah

    Swah

    Joined:
    May 13, 2015
    Posts:
    25
    What do you mean by "not working"? Is it still sending analytics? Or preventing another service from working as intended (ex: IAP or else)?

    Leonid - did you download Unity's plugin for your tests, or did you just set Analytics.enabled = false?

    Note that we might not be preventing analytics soon enough by setting Analytics.enabled = false. I think some personal data is sent in the appStart event. I don't know if we can set the flag to false before that is sent.
     
  15. Basti_TinyRoar

    Basti_TinyRoar

    Joined:
    Oct 4, 2016
    Posts:
    3
    I meant that its still sending stuff to unity at start of the app which I don't want. IAP still works after disabling Analytics at runtime for me
     
  16. Swah

    Swah

    Joined:
    May 13, 2015
    Posts:
    25
    Understood, thanks for the clarification. That is indeed unfortunate - it seems like Unity will basically always collect info, and then allow users to opt-out after the fact.

    The only "easy" way I could see around this is if disabling analytics for the entire project through Unity website prevents that data from being collected entirely. I don't know if we can do this while other services that rely on it, such as IAP, are enabled.
     
  17. Leonid

    Leonid

    Joined:
    Aug 20, 2013
    Posts:
    35
    i've downloaded plugin
     
  18. MoribitoMT

    MoribitoMT

    Joined:
    Jun 1, 2013
    Posts:
    294
    Hi,

    I think this system not rely good choice for developers who wants to create their own consent page. I would like to create my own consent page for only NoN-Pers. data and set all third parties via code from single consent page decison. Otherwise many developers will need page after page consent.
     
    Leonid and sandbaydev like this.
  19. mmvlad

    mmvlad

    Joined:
    Dec 31, 2014
    Posts:
    85
    Unity's legal team representative told me that if you mark the game as for kids, it will make Analytics and other Unity services not to collect personal info and you won't need consent then. So this is one way for now I guess if you don't heavily rely on targeted Unity Ads.
     
    MoribitoMT likes this.
  20. IvyKun

    IvyKun

    Joined:
    Sep 28, 2013
    Posts:
    96
    So it will be possible to do all this server side without updating the games?

    If I go to my analytics dashboard and change the COPAA settings:



    And then go to my ads dashboard and do the same:



    Will that work? That will be a really good temporal solution until we can update everything. At least a better solution than just un-publish in Europe.

    I can't do this with ads because I'm using mediation with a few other networks so I need to update sdks, but for analytics this will be awesome.

    Or have the option to just disable analytics completely from the server for a project, that will be the best option but not sure what will happen with IAPs... :S
     
  21. mmvlad

    mmvlad

    Joined:
    Dec 31, 2014
    Posts:
    85
    @IvyKun I didn't completely understant this part - "Please note that COPPA designation is permanent and cannot be changed once it is set."
    If its permanent - why does it change in dashboard?
     
  22. IvyKun

    IvyKun

    Joined:
    Sep 28, 2013
    Posts:
    96
    @mmvlad that's a good question. I didn't try to change it but because of the dropdown behaviour it looks that it can be done... It let me change the value although I didn't click save.



    Maybe it doesn't do anything and just keeps the old value? Anyway we don't know if this is the way to go yet.
     
  23. coshea

    coshea

    Joined:
    Dec 20, 2012
    Posts:
    252
    Not what I've heard and that statement contradicts what they wrote here

    https://docs.unity3d.com/Manual/UnityAnalyticsCOPPA.html

    "In addition to these IDs, Unity Analytics also collects the following personal information from Child App users: IP address, identifiers for advertisers (IDFA is only collected if Unity Ads is also enabled) and device identifiers (IDFV, Android device ID or IMEI if Android device ID is unavailable)."

    So a child directed app still collects IP Address, and device identifiers (IDFV, Android device ID or IMEI if Android device ID is unavailable).
     
    spacepluk likes this.
  24. coshea

    coshea

    Joined:
    Dec 20, 2012
    Posts:
    252
    I have emailed Unity, will post reply here when I get it...

    ----
    There are a lot of questions from developers around consent and analytics to be GDPR compliant.

    With the new system from Unity Analytics Privacy SDK, users can opt OUT of data collection but not opt IN. The only mention of consent on the GDPR FAQ is regarding ads, not analytics.

    Information on consent required by GDPR for use of personal information
    https://ico.org.uk/for-organisation...ion-gdpr/lawful-basis-for-processing/consent/

    To me it seems like Unity analytics and this SDK at the moment isn’t GDPR compliant, because you/developers aren’t asking for clear consent being using any personal information.

    It would be great for a clear answer from you and your lawyers regarding this and why Unity has gone with opt-out.

    Many developers would rather not ask players for consent as the terms can look quite scary to users, what are they doing with my personal data etc. Even if a game is marked for children for COPPA, Unity still collects PII.

    To please developers that would like to keep using analytics, but not have to require consent and use PII, why not give an option to anonymise IP address? Google Analytics does this for example.

    I imagine you’d rather keep those developers (especially those paying for Pro), than loose the analytics all together.

    I appreciate all this GDPR stuff is tricky, but would be grateful if you could answer the above and I will post reply on the forum too.






    --
    Chris O'Shea

    Cowly Owl
    www.cowlyowl.com
     
  25. IvyKun

    IvyKun

    Joined:
    Sep 28, 2013
    Posts:
    96
    I think all of this stuff should be replied in the forum... it doesn't make sense to send thousands of emails to unity legal team when probably 80% of us will ask very similar questions.
     
  26. coshea

    coshea

    Joined:
    Dec 20, 2012
    Posts:
    252
    I agree, but every reply to anything legal from Unity has told us to email them...

    https://forum.unity.com/threads/unity-analytics-and-gdpr.513112/page-3#post-3504976
    https://forum.unity.com/threads/unity-analytics-and-gdpr.513112/#post-3476728
    https://forum.unity.com/threads/uni...e-now-in-the-asset-store.532484/#post-3506558

    They are only answering technical questions on the forum it seems, the tech people don't want to give the wrong legal answer and get them in trouble.
     
  27. MoribitoMT

    MoribitoMT

    Joined:
    Jun 1, 2013
    Posts:
    294
    Unless there is clarification, I will stop using Unity IAP, and work with other third party IAP provider who does not collect analytic data.
     
    spacepluk likes this.
  28. MoribitoMT

    MoribitoMT

    Joined:
    Jun 1, 2013
    Posts:
    294
    Leonid likes this.
  29. marcopesce

    marcopesce

    Joined:
    Dec 11, 2015
    Posts:
    40
    Why I still cannot see the consent request on ads? Does all this start only after May 25, 2018?
     
  30. mmvlad

    mmvlad

    Joined:
    Dec 31, 2014
    Posts:
    85
    Leonid likes this.
  31. TalhaDX

    TalhaDX

    Joined:
    Feb 2, 2013
    Posts:
    94
    With 25 apps to update when you didn't even made them and hired freelancers. It is a difficult task to update them all. May be you need another freelancer to update them. Let me know if I can help you in this matter.
     
  32. Leonid

    Leonid

    Joined:
    Aug 20, 2013
    Posts:
    35
    Please give me some advice. Where should i put "Opt-out" button in my mobile game according to GDPR rules?
    In the Main menu screen or in Settings screen?
    Thank you!
     
  33. Mattias-Wargren

    Mattias-Wargren

    Joined:
    Jun 25, 2012
    Posts:
    9
  34. Mattias-Wargren

    Mattias-Wargren

    Joined:
    Jun 25, 2012
    Posts:
    9
    I think the "the nice dev solution" would be ¬

    - Inform the user that the game uses Unity Analytics (at app start, first time)
    - Inform the user where in the app they can opt-out (opt-out the Unity way that is)
    - Implement the opt-out button in an easy accessible menu
     
    Leonid likes this.
  35. IvyKun

    IvyKun

    Joined:
    Sep 28, 2013
    Posts:
    96
    Appodeal made an example of user content dialog (there's a unity demo to download).
    https://blog.appodeal.com/blog/2018/05/08/appodeal-gdpr-guide/

    I'm going to use that so the user can opt-in or out of targeted ads and set the flag via code. Not sure if I need to put also the data privacy button or opting in or out in the ads will be enough.

    In the plugin it says that the the plugin is unnecessary if you’re using Unity Ads. So if you set the content flag of Unity Ads, the one in that link, I understand that will work too with analytics.

    Some confirmation of this will be good, but if it works with the content unity ads show after an ad, it should work with the code version too.

    Edit: I saw your reply now in the other thread about not using Uniy Ads.
     
  36. MoribitoMT

    MoribitoMT

    Joined:
    Jun 1, 2013
    Posts:
    294
    So as result,

    I need to implement Unity Ads to disable Unity Analytics for only Using Unity IAP via code. Wow tedious process..
     
  37. JDestrier

    JDestrier

    Joined:
    Jul 2, 2015
    Posts:
    3
  38. IvyKun

    IvyKun

    Joined:
    Sep 28, 2013
    Posts:
    96
    I just installed Candy Crush to take a look at what they've done and they only have a dialog saying they have updated they privacy policy and that the user need to accept to continue playing. And just a big green accept button.

    I thought that was not an option?

    Other games I have checked are saying something similar but saying the user can opt-out by going to some link and that they share the data with third-parties to improve advertising etc.

    Also instead of giving and opt-out button, like supercell they just put this on text and that's it?

    You can opt-out of interest-based advertising on mobile applications by checking the privacy settings of your Android or iOS device and selecting "limit ad tracking" (Apple iOS) or "opt-out of interest based ads" (Android).

    I'm not sure this is good for GDPR because the user will opt-out of everything and not just your app, but sure it's an easy and good solution for us.
     
    Last edited: May 24, 2018
  39. jboetel

    jboetel

    Joined:
    Jul 13, 2014
    Posts:
    11
    Yeah, no. Definitely not worth it. We're ripping out everything related to Unity services instead. There goes Performance Reporting, there goes Custom Events and the nice things that come with it, all of which have been instrumental in improving the game experience for our premium ad-free PC game. We don't even want IP addresses or any other personally identifiable information. Never have. We just wanted to make the game better. Oh well...
     
  40. Leonid

    Leonid

    Joined:
    Aug 20, 2013
    Posts:
    35
    I have requested comments by email, and recieved a reply today.
    It seems what we can disable Analytics via code. But we also need to hit checkbox "Disable HW statistics" under Player settings - Other settings.
    And what is strange - that checkbox is only available with Pro licence.
     
    Last edited: May 25, 2018
    JamesArndt, sandbaydev and technicat like this.
  41. technicat

    technicat

    Joined:
    Nov 22, 2006
    Posts:
    1,277
    Hopefully there is a patch or update on the way that enables Disable HW Statistics for Unity Personal Edition.
     
    JamesArndt and MoribitoMT like this.
  42. technicat

    technicat

    Joined:
    Nov 22, 2006
    Posts:
    1,277
    Actually, seems like they should just remove HW Statistics reporting.
     
  43. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    3
    Is this for real? Surely there should be the option to implement Unity IAP that is GDPR compliant out of the box (and only if we want to collect more detailed analytics about the purchase would we need to ask for permission). So I'm guessing that (unfortunately) we should just avoid Unity IAP altogether and buy an IAP plugin from the asset store?

    Also, is there not some way of collecting anonymous data that is GDPR compliant, to help tune a game; or is collecting any data without explicit consent illegal?
     
  44. MoribitoMT

    MoribitoMT

    Joined:
    Jun 1, 2013
    Posts:
    294
    Is something wrong with us ?

    We are here 5-10 developers keep discussing GDPR compliance, but nobody else. I also see that most of big developers did not even updated their games / apps ? It is like nobody cares it, but just us..
     
    jashan, spacepluk and technicat like this.
  45. IvyKun

    IvyKun

    Joined:
    Sep 28, 2013
    Posts:
    96
    I was thinking the same this morning. I took a look at the top games of the play store to see what kind of dialog they've implemented and to see if they put something in the "What's new" section and only a few have updated. Mainly the big companies, but not all of them or not all of their games...
     
  46. VIC20

    VIC20

    Joined:
    Jan 19, 2008
    Posts:
    2,408
    It is illegal to connect to a server outside of the EU without consent because the IP (at least in Germany) is considered as personal data. It does not help if you anonymize unique device identifiers in this case.

    You need consent to transfer data outside of the EU. But it looks like Unity is not on the list of privacy shield: https://www.privacyshield.gov/participant_search

    legitimate interest“ – There is no need to send the statistics form a developers point of view. The customer buys the software from the developer, not from Unity. So there is no legitimate interest.

    EDIT: It took me a while to understand the concept: This works only if you consider the game as a collection of different components and not as a single product (which it clearly is because we are only licensees of the Unity engine). In this case it would be a legitimate interest of Unity to collect anonymized statistics. I guess thats why the data processing addendum is “controller to controller“ (which I never saw before) and why we need to add the link to Unity’s privacy policy in our privacy policy.

    While this sounds a little bit more convincing for me now you should always remember that the GDPR is such a mess that even the Law Society of Düsseldorf, Germany decided to shut down their website. https://www.heise.de/security/meldu...tenkabinett-4057866.html?hg=1&hgi=3&hgf=false

    Anyway it would be a nice move to offer “disable HW stats“ as a non-pro option.
     
    Last edited: May 27, 2018
    technicat likes this.
  47. technicat

    technicat

    Joined:
    Nov 22, 2006
    Posts:
    1,277
    Ultimately I think Unity should have an appropriate popup automatically appear when the game launches if it has HW Statistics, Analytics, or anything else enabled that requires user consent, much like the permissions popups you get for device permissions (camera, notifications...). This takes the onus off the developers, ensures the consent is given early enough, removes risk for everyone, and makes sense if you think of Unity as a platform (sort of like iOS). Right now we’re going to have a mixture of people who stop using Unity services, people who continue to use them but won’t bother using the privacy plugin, and people who use the privacy plugin but are still at risk of being non-compliant.
     
    sandbaydev likes this.
  48. dorukeker

    dorukeker

    Joined:
    Dec 6, 2016
    Posts:
    30
    For those in Unite Europe next month there is a session on June 20th - Breakout 4 - 09:00AM only on GDPR
     
    sandbaydev likes this.
  49. VIC20

    VIC20

    Joined:
    Jan 19, 2008
    Posts:
    2,408
    There is no time for people to wait for a month. The lawyers in Germany are starting their cash machines – it is a huge business model here: https://en.wikipedia.org/wiki/Abmahnung (read the last sentence to understand the problem)
     
    MoribitoMT likes this.
  50. technicat

    technicat

    Joined:
    Nov 22, 2006
    Posts:
    1,277
    I just noticed this notice in the Operate section of the Unity Dashboard. It is not as complete as the initial post of this thread, just saying "if you only run Unity Ads" and "if you do not use Unity Ads, but use Unity Analytics", neglecting the case where you use both.
     

    Attached Files: