Search Unity

  1. Welcome to the Unity Forums! Please take the time to read our Code of Conduct to familiarize yourself with the forum rules and how to post constructively.
  2. We have updated the language to the Editor Terms based on feedback from our employees and community. Learn more.
    Dismiss Notice
  3. Join us on November 16th, 2023, between 1 pm and 9 pm CET for Ask the Experts Online on Discord and on Unity Discussions.
    Dismiss Notice
New Forum User Notice Update to the Unity Editor Software Terms Unite 2023 - Ask the Experts Online

Unity IAP unsupported for Kids Apps on iOS ? (at the moment)

Discussion in 'Unity IAP' started by Jonsi, Jul 1, 2020.

  1. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    Unity IAP is really great, but it seems that if you're using it in a kids app you're going to have a hard time releasing it on iOS. This is due to Unity Analytics being included with IAP, which violates Apple Guideline 1.3 - Safety - Kids Category ... details given below.

    As far as I know, there is currently no solution (but I'd be very happy to be proved wrong on this).

    To save other developers time, would the Unity IAP team consider either :-

    1) Highlighting this restriction in the Unity IAP knowledge base https://support.unity3d.com/hc/en-u...28.727494493.1593447020-2036023412.1592647924 and/or pinning a message at the top of the Unity IAP forum.

    2) If there is a robust solution, adding it to the Unity IAP knowledge base. Even if this solution is currently to use one of the several 3rd party assets on the asset store.

    3) A fix that decouples IAP and analytics.



    ------------------------------

    App rejected 30th Jun 2020, using Unity 2019.4.1f1 & Unity IAP 1.23.2

    Guideline 1.3 - Safety - Kids Category

    We noticed that your Kids Category app includes analytics, advertising and collects, transmits, or has the ability to share personal information or device information with third parties.

    Your app includes the following feature(s), contrary to guideline 1.3 of the App Store Review Guidelines:

    Third-party analytics or third-party advertising with the ability to collect, transmit or share identifiable information, including, for example, IDFA.

    Next Steps

    To resolve this issue, please remove this functionality or revise your app so that no personally identifiable information or device information is sent to third parties.--
     
    Jonsi, Jul 1, 2020
    #1
    nicholasr likes this.

  2. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    JeffDUnity3D, Jul 1, 2020
    #2

  3. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    @JeffDUnity3D It's the presence of the analytics that causes rejection for kids apps - not the IAP.

    My post was just suggesting that if there is a known work around it would be soooooo helpful to make it more visible.

    At the moment there seem to be fragments of knowledge and experience in various threads suggesting things that might work and then often people saying that those things have not been successful for them and they've given up and used a 3rd party asset without analytics instead.

    As it stands, developers most likely won't be aware of this issue until they try to submit an iOS kids app for review. Even the suggestion to disable Analytics at runtime for iOS kids apps would be a useful start - as far as I'm aware you only discover this by digging in the forums once you encounter the problem (apologies if this is not the case).

    I say this with all the best motives. Unity is such a fantastic product and you guys do such a great job helping with people's issues.
     
    Jonsi, Jul 1, 2020
    #3
    nicholasr likes this.

  4. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    I can assure you that I am not hiding any known workarounds. If Analytics is the issue, then you should be able to disable Analytics at runtime. Indeed, I've read reports that the stores accepted the app the very next day after prior rejection, without any submission by the developer. It's not consistent. My current theory is that IAP may be sending an event, even with Analytics disabled. A Charles capture would confirm. But I've see similar reports already, and I have let the IAP team know.
     
    JeffDUnity3D, Jul 1, 2020
    #4
    nicholasr likes this.

  5. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    This is the code that should disable Analytics at runtime. Place it in either in Awake() or a method with the OnLoad attribute set

    https://docs.unity3d.com/ScriptReference/RuntimeInitializeOnLoadMethodAttribute.html

    Analytics.initializeOnStartup = false;
    Analytics.enabled = false;
    PerformanceReporting.enabled = false;
    Analytics.limitUserTracking = true;
    Analytics.deviceStatsEnabled = false;

    It would be interesting to see what the Charles capture would look like during an IAP purchase
     
    Last edited: Jan 8, 2021
    JeffDUnity3D, Jul 1, 2020
    #5
    yyylny likes this.

  6. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    Jonsi, Jul 2, 2020
    #6

  7. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    @JeffDUnity3D OK - so I tried the above - but I went a bit off piste and set Analytics.limitUserTracking = true (let me know if I should have left it as false).

    As you predicted, I do get a call to ecommerce.iap.unity3d.com

    Charles.jpg

    One thing that may or may not be relevant:-
    I inserted the disable analytics code on the Awake of the controller script of my first scene, but when I watched the logs in Xcode I get some UnityIAP activity before this code is executed.
    LogOrder.jpg

    Let me know if any more info/captures would help.

    Oh also the IAP code doesn't work when Charles Proxy is being used - I'm guessing this is expected behaviour? When I disabled it all worked again.

    Any ideas what the call to ecommerce.iap.unity3d.com is there for? I'm guessing this may be the kind of thing Apple would object to. Would it be classified as analytics? Any ideas what the call is for?
     
    Last edited: Jul 2, 2020
    Jonsi, Jul 2, 2020
    #7

  8. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    Yes, that appears to a call that we would use to track your IAP revenue on the Analytics dashboard, it should not be sent. We are working on that. But it's not definite yet if that is the issue that Apple is concerned with. Did you add the CharlesProxy.unitypackage to your project? The request is still encrypted, it may contain the deviceID.
     
    JeffDUnity3D, Jul 2, 2020
    #8

  9. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    Ah no - I didn't add that package to my project. Should I have? I interpreted the document as saying that this step was just required for Android (to fiddle the manifest) - but I might have misunderstood. Maybe it does all sorts of things depending on your build? Should I include it for iOS and try again?
     
    Jonsi, Jul 2, 2020
    #9

  10. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    My mistake, clearly you're on iOS. The package is only for Android. Did you add the SSL Settings in Charles?
     

    Attached Files:

    JeffDUnity3D, Jul 2, 2020
    #10

  11. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    Ah, not quite. I think in the doc it says to use wildcard *.* which I thought I'd done. I'll go and check and add the more specific unity settings as in your settings file above too.
     
    Jonsi, Jul 2, 2020
    #11

  12. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    @JeffDUnity3D OK - here is the detail. I've obfuscated some of the details - let me know if that renders it useless.

    Also it may be worth adding your great SSLSettings.png to the Charles Proxy instructions doc.

    So it looks like it sends some sort of device id and user id. I guess this may be problematic for Apple's new review requirements for kids? It sounds like it might be classified as "personally identifiable information or device information" which was the reason given for rejection? But I don't know exactly what is allowed and what is forbidden.

    Charles2.jpg
     
    Jonsi, Jul 2, 2020
    #12

  13. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    Yes, that is concerning, I have let the IAP team know. And I have updated the doc, thank you for the feedback. If you limit the SSL to unity3d.com and unity.com without the *.*:* wildcard, IAP should still work with Charles running.
     
    JeffDUnity3D, Jul 2, 2020
    #13

  14. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    @JeffDUnity3D thanks. Any idea how long before we're likely to get any response from the IAP team? Do they have any contact with Apple to clarify what is allowed?
     
    Jonsi, Jul 2, 2020
    #14

  15. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    No ETA yet, I'm also in touch with our legal team and product teams here and we are trying to get more information.
     
    JeffDUnity3D, Jul 2, 2020
    #15

  16. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    @JeffDUnity3D OK. Many thanks for your help with this - much appreciated!
     
    Jonsi, Jul 2, 2020
    #16

  17. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    @JeffDUnity3D Just checking if there is any more info on this - or any idea when there may be.

    Is the premise that what is being sent may be legitimate (and we'd need to present that argument to Apple on review), or is the aim to remove that call, or is there another way in code/config to suppress that call?

    I've an app waiting to be resubmitted and would appreciate an update.

    Many thanks!
     
    Jonsi, Jul 6, 2020
    #17

  18. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    It's on track for our next release hopefully, no ETA yet but they've been coming out pretty fast lately for these highest priority issues.
     
    JeffDUnity3D, Jul 7, 2020
    #18

  19. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    @JeffDUnity3D thanks for the update. Sounds hopeful. So will the fix be a combination of ensuring you have analytics explicitly switched off in code (as you documented above) in combination with an updated Unity IAP package?
     
    Jonsi, Jul 7, 2020
    #19

  20. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    Correct.
     
    JeffDUnity3D, Jul 7, 2020
    #20
    Jonsi likes this.

  21. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    @JeffDUnity3D Hi there. Any idea of an ETA for the fix yet? I've an app that I really need to release. Many thanks!
     
    Jonsi, Jul 14, 2020
    #21

  22. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    No ETA, we are still trying to determine the actual issue.
     
    JeffDUnity3D, Jul 14, 2020
    #22

  23. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    Thanks for the update.
    Does this mean via a dialogue with Apple? i.e. to determine exactly what data should be allowed to be sent (and maybe to then argue that what is being sent is ok, or maybe to argue that Unity analytics should not be classified as 3rd party).
    Or is there an issue working out how/why/where the call is being made?

    Should I be trying to argue the case, with Apple, for the legitimacy of the data being sent and try and get my app through review that way? The reviewer was pretty specific in the requirement that no "personally identifiable information or device information" should be sent to 3rd parties and I don't feel I have sufficient knowledge of what Unity Analytics is doing and why to make a strong case. On the face of it, using Charles Proxy to monitor the calls, it looks like this kind of prohibited data is being sent. Does this not happen in your tests? Maybe I'm not setting all the analytics off correctly?

    I'm sure you'll appreciate just how frustrating this is. This has been rumbling on for some time (since before the original deadline was extended) and we still have no documented, proven way to actually release an iOS app for kids using Unity IAP.
     
    Jonsi, Jul 14, 2020
    #23

  24. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    We are investigating here, I don't believe there is any action you can take. It appears that the store may be inspecting the binary and finding any string with the word "advertising" and rejecting even if the code is never used. We are searching our code base and reaching out to the legal and engineering teams from both companies once again. The store policies are a moving target and change from week to week.
     
    JeffDUnity3D, Jul 14, 2020
    #24

  25. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    Right - but has the call that we saw with deviceid and userid been removed? Maybe removing such calls would be enough. Wouldn't it be worth a try?
    If these sorts of calls were not made (when analytics are switched off) I'd be able to answer "No" to the questions about analytics and advertising being in the app, which may be sufficient to pass review.
    Do we know that the binary is being inspected, or is it supposition?
     
    Jonsi, Jul 14, 2020
    #25

  26. JeffDUnity3D

    JeffDUnity3D

    Unity Technologies

    Joined:
    May 2, 2017
    Posts:
    14,446
    You are correct, we are removing the legacy calls in an upcoming release, sorry for the confusion. I personally made the case to engineering here, and tested a preview build that sends no events. We are testing the release now, no specific ETA but this is a high priority issue for us also. And correct, we don't want to suppose on the store review process, we are checking. We had a meeting 2 weeks ago on this very topic and it's already changed again.
     
    JeffDUnity3D, Jul 14, 2020
    #26

  27. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    OK - thanks for clarifying and for all your work on this. Obviously, we really need this asap.
     
    Jonsi, Jul 14, 2020
    #27

  28. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    I've just seen Unity IAP 1.23.4 is released with the following change :-

    ### Removed
    - Analytics - For publication to Kids Category on Google Play and Apple App Store, removed `SystemInfo.deviceUniqueIdentifier` collection and sharing with `ecommerce.iap.unity3d.com` server.

    Great work! Thanks so much guys! I'll try submitting an update to Apple shortly.
     
    Last edited: Jul 18, 2020
    Jonsi, Jul 17, 2020
    #28
    nicholasr and JeffDUnity3D like this.

  29. MohHeader

    MohHeader

    Joined:
    Aug 12, 2015
    Posts:
    41
    @Jonsi, were you able to get the approval from Apple with this new updated IAP release?

    Thanks
     
    MohHeader, Jul 22, 2020
    #29

  30. Jonsi

    Jonsi

    Joined:
    May 21, 2013
    Posts:
    45
    @MohHeader Sorry for the delayed response. The review process seemed to take a while for other spurious reasons. Not sure if I got super rigorous reviewers this time or what. But YES! I got notification this morning that our app has gone through review! I used the latest version of IAP and switched off analytics as described in the thread. Thanks again to the Unity folks (@JeffDUnity3D) for helping with this!
     
    Jonsi, Jul 31, 2020
    #30
    MohHeader and JeffDUnity3D like this.