Resolved Unity IAP and Export compliance

Hello,
I want to release my first app to Google Play and App Store. I have a question about Export Compliance issue. Since I didn't even know this is needed I am struggling.

I made the game using Unity, and I am using Unity IAP for in-game purchases. Since I didn't add any encryption on my own into the game and answers on Unity Forums are mixed, could someone please help me with an answer to those 2 questions in app store and do I need to do anything additional?

First question:


If the answer to first is yes, this is the second one



Thank you in advance!

 

There isn't a default option so basically I have to choose either yes or no myself. I would reach out to Apple or the US government, but I do need to know if Unity IAP uses encryption and what kind of if it does?

Also what about Unity Ads and Analytics?

And if you've used Unity IAP and published to App Store or Google Play, have you ever submited a year-end self classification report to the US government, as you would have to do if your app makes any calls to HTTPS (if Unity IAP or Ads does that ofc)

 

Okay I wrote to the Apple support but they can't advise me on legal matters, only technical support. Can I ask you what do you usually select when publishing an app with Unity IAP or Ads?

 

I wrote an answer to a similar question on Unity answers: https://answers.unity.com/answers/1668819/view.html
In short, I believe if you use Unity IAP/Analytics you should be exempt (it should fall under Mass market encryption object code software that is made "publicly available"). To avoid being asked this question at submission, just set the
ITSAppUsesNonExemptEncryption flag to NO in your Info.plist file before building. That will declare you are exempt (assuming you are only using exempt encryption).
Disclaimer: this is not legal advice nor am I a legal professional.

 

If this further helps...

I asked ChatGPT AI, and it verified what DrTomato said.

I chose "yes" for exemption, because I'm only using Unity's ads, IAP, and analytics; I won't be reporting.