Unity Analytics and GDPR

A few questions to which we need definitive answers:

1. If an app uses Unity Unity Analytics AND Unity IAP, will Unity IAPs continue functioning if a user opts out of Unity Analytics? Less important than retaining purchase functionality, but what happens to the revenue data for this user w/ respect to the revenue dashboards in Analytics?
2. If an app uses Unity Analytics AND Unity Tutorial Manager, will Tutorial Manager continue functioning if a user opts out of Unity Analytics?
3. Do apps that are already marked as "directed towards children" need to include the Data Privacy Plugin?
4. What are the differences (as far as collecting information goes) for apps that are marked "directed towards children" vs when a user opts out using the Unity Data Privacy Plugin?

 

Is there any reason we can't skip this step and opt-out by default? Don't think single player games need to gather any information?

 

We received some answers from the GDPR staff at Unity via gdpr@unity3d.com and dpo@unity3d.com. They mentioned that they are busy fielding emails and other requests that they haven't had as much time to respond to everyone on the forums. If you have posted questions that haven't been answered they recommend emailing the addresses above.

Here are some of the questions we asked and Unity's answers.

Q: If an app uses Unity Analytics AND Unity IAP, will Unity IAPs continue functioning if a user opts out of Unity Analytics?
A: Yes. The opt-out doesn't apply to the data needed for these transactions.

Q: Will revenue data for users who opt-out continue showing up in the revenue dashboards in analytics?
A: Yes. This isn't personal data under GDPR.

Q: If an app uses Unity Analytics AND Unity Tutorial Manager, will Tutorial Manager continue functioning if a user opts out of Unity Analytics?
A: Yes. Tutorial Manager should remain unaffected.

Q: Where can we get more information on the differences between apps that are marked COPPA compliant vs when a user opts out?
A: Here's a link to what's happening when the COPPA flag is enabled:
https://docs.unity3d.com/2018.1/Documentation/Manual/UnityAnalyticsCOPPA.html

Q: Do apps that are already marked as "directed towards children" need to include the Data Privacy Plugin?
A: Please do. Unity would prefer that you implement the plugin for these apps even though the data is quarantined and anonymized.

 

My understanding based on these posts
https://forum.unity.com/threads/uni...in-the-asset-store.532484/page-2#post-3512468
https://forum.unity.com/threads/uni...in-the-asset-store.532484/page-2#post-3515845

Players aren't opting out of analytics, they are opting out of their personal data (ip/device id) being used with analytics, the analytics still happens.

"For players who have opted-out, Unity will remove personal data and identifiable information in our backend system through a mixed process of deletion and anonymization. Unity will also prevent future storage of personally identifiable information."

"Q: Do apps that are already marked as "directed towards children" need to include the Data Privacy Plugin?
A: Please do. Unity would prefer that you implement the plugin for these apps even though the data is quarantined and anonymized."

Is the data anonymized? Child directed apps include this personal data, so yes you need the plugin, but the coppa page says:

"In addition to these IDs, Unity Analytics also collects the following personal information from Child App users: IP address, identifiers for advertisers (IDFA is only collected if Unity Ads is also enabled) and device identifiers (IDFV, Android device ID or IMEI if Android device ID is unavailable)."

 

Is there any way to make this feature an opt-in? I don't want to send anything from the user's device unless they've accept the ToS and allow the game to send data out, but Unity send everything from the very beginning.

 

Hope that you can help me with this little question

Is there any way to make this feature an opt-in? I don't want to send anything from the user's device unless they've accept the ToS and allow the game to send data out, but Unity send everything from the very beginning.

 

https://unity3d.com/legal/privacy-policy

I think this needs to be clearer that the developer does not have access to the ip address and device identifiers "the developer of the game has ongoing access to this data", as the event data forms part of the same sentence as ip/device

 

I think we can access those data somehow (but indirectly) by accessing the Analytics panel from Unity Dashboard, you know, like, where players from, new user, session time... But the current way of saying from Unity is like we can access those data directly, and they just collect it for the sake of developers (which is not). God, I hate lawyers and their sly words

 

I still see it disabled in 2018.1.3. So is Unity still embedding a violation of this law into the Editor and then expecting developers to cover the issue? I am a bit ignorant on understanding everything this law encompasses nor can I afford a lawyer. Are the Unity Editor HW Statistics compliant with the EU law in that they don't collect any personal data?

 

Can Unity Analytics data be hosted in the EU?

How to make an opt-in instead of opt-out?

For now it looks like we have to switch off analytics sadly..

 

What is final verdict with Unity GDPR compliance ? Is it %100 ?

 

I'm curious too? Do we have to do anything on our end or is it now embedded in the Unity player itself now?

 

For what I understood, our current problems with analytics are:
- IP-addresses count as personal identifiable information, and is used by unity analytics
- unity analytics provides an opt-out instead of an opt-in. We need opt-in.
- data is transfered outside of the EU

 

When hitting "play" in the editor, I see the following in the console:
Opt-out preferences successfully retrieved, applied and saved:
{"optOut":false,"analyticsEnabled":true,"deviceStatsEnabled":true,"limitUserTracking":false,"performanceReportingEnabled":true}

Is it possible to set everything to false from code, except for analyticsEnabled? And if so, will remotesettings and analytics still work?

 

Anything new?

 

Any updates on this Unity?

 

No changes in this area. It would not be a possible to "set everything false from code", you could use a new user.