Unity & Privacy

Hi everyone,

due to a recent iOS app rejection, I'm thinking that we (developers) don't have any control or information about what kind of data is Unity collecting about our users. Projects made with Unity are OUR projects, and therefore, players are OUR users.
It should be a way to decide what kind of data we want to share with Unity, and of course, a way to stop Unity collect any kind of data.
I think it's not only an ethical issue, but also a legal one.
For example, Apple is asking us what kind of information are we collecting from our users. It's shocking that we don't have and honest answer about that, because we don't really know. How it's that even possible?

What do you think?

Regards,

Albert

 

What gets collected is outlined in Unity's Privacy Policy. There's also the Unity, GDPR and Data Privacy – FAQ.

If you don't want ANY data to be collected, enable "Disable HW Statistics" in the Player settings. In case you use other Unity Developer Services, such as Analytics, IAP, Multiplayer, or Performance Reporting, you should implement the Unity Data Privacy Plug-in asset, so that your players can manage their privacy settings.

 

So your app was rejected because when you exported to iOS, the export included systems that come with Unity that collect user data?

 

We disabled analytics, ads and all services. We also enabled "Disable HW Statistics". But the app still access the IDFA (ads identifier) and Apple keeps rejecting it. So, we are wondering... is really data not being collected? How can we be sure?
Also, our users are children and they cannot manage and understand privacy settings.

 

Just saw that you've also posted in the below thread and Unity Answers with more information:
- https://forum.unity.com/threads/ios-advertising-identifier-rejection.226107/#post-5384034
- https://answers.unity.com/questions/1692559/ios-app-rejected-due-to-use-of-idfa-ads-identifier.html


Do you have other third-party assets in use that may use the IDFA?

Look out in your project's code for any of these:
class:

ASIdentifierManager

selector:

advertisingIdentifier

framework:

AdSupport.framework

Even if you don't use Analytics or serve Ads, your project may contain traces of code that references to that and thus your app gets rejected.

 

Thanks for your answers, Mauri. No, I don't have other third-party assets that may use the IDFA.
It seems (I don't know for sure, the app hasn't been approved yet) that the problem is in the file "DeviceSettings.mm" (xCode, Under Unity->Classes). Even for a new an empty project, with nothing in it and not linked to services, this file contains this code:

#include <AdSupport/ASIdentifierManager.h>
// ad/vendor ids
static id QueryASIdentifierManager()
{
NSBundle* bundle = [NSBundle bundleWithPath: @"/System/Library/Frameworks/AdSupport.framework"];

if (bundle)
{
[bundle load];

Class retClass = [bundle classNamed: @"ASIdentifierManager"];

return [retClass performSelector: @Selector(sharedManager)];
}
return nil;
}

extern "C" const char* UnityAdvertisingIdentifier()
{
static const char* _ADID = NULL;
static const NSString* _ADIDNSString = nil;

// ad id can be reset during app lifetime
id manager = QueryASIdentifierManager();
if (manager)
{
NSString* adid = [[manager performSelector: @Selector(advertisingIdentifier)] UUIDString];
// Do stuff to avoid UTF8String leaks. We still leak if ADID changes, but that shouldn't happen too often.
if (![_ADIDNSString isEqualToString: adid])
{
_ADIDNSString = adid;
free((void*)_ADID);
_ADID = AllocCString(adid);
}

}
return _ADID;
}

 

That may be the culprit. See this thread here for a workaround:
https://forum.unity.com/threads/ios-advertising-identifier-rejection-faq.226187/

 

Yes, I have upload a new binary following this thread, and I'm waiting Apple response. But the question is: why is this happening?
Why Unity collects this information? It doesn't seem right to me. In fact, it seem ilegal to me. Unity can't collect information from our users if we are telling Unity to not collect it.

 

What happened is that this code bit, which is required for Ads, is in that

DeviceSettings.mm

file by default. However, it won't do anything if you don't use Ads. It is simply an API meant for Unity Ads and other plugins that serve advertisements.

Since you don't use Ads, Apple - as strict as they are with so many things - told you "it would be appropriate to remove this section of code entirely from your app" in case "your app is not meant to use the advertising identifier".

You should be fine if you remove said code and re-submit your app again.