Google Play keeps detecting collection of personal and sensitive information, rejecting my app

[JuliusM]

@AcidArrow

So which one is it?

It shouldn’t be mentioned in the known issues section.

[JuliusM]

@coshea_1

So here is an important question, it seems from the earlier posts that even if you have analytics turned off and no plugins that cause outgoing traffic, Google is scanning the apks for reference to Android Device ID and Advertisting ID. Even if you aren’t using them, but they are included as part of the Unity code that we can’t access, they are causing app removals.

This was the same issue in iOS, but there was at least a solution to manually remove these references posted in the xcode project. Is there any way to do this on Android?

Also is there any way to take your apk from Unity and scan for Android Device ID and Advertisting ID yourself somehow?

This was an issue for iOS, but it’s not an issue for Android. The detection happens when the Android ID or Advertising ID is accessed.

[CL-bburrage]

@JuliusM @JeffDUnity3D Confirmed that the HW Stats fix worked for one of our 2017 LTS apps (we threw in the Analytics manifest fix too just in case). The app was approved for publishing this morning! So we will work on all the others.

Thank you both so much!

Indeed planning a step-wise upgrade to 2018 LTS and work up the chain.

[chriszul]

My company had 3 apps removed from play store yesterday with this exact message.
Updating our apps to Unity 2020.1.b12 did not work, app updates were still rejected.
I am trying a build with the runtime analytics deactivation code today - but your response is not clear which RuntimeInitializeLoadType to use to properly deactivate analytics? @JeffDUnity3D

Unity - Scripting API: RuntimeInitializeLoadType

[SlimeProphet]

This is a bummer. We moved to Unity because the devs of our prior engine couldn’t keep it up to date with Apple’s and Google’s requirements. I thought Unity would be too big to fail like this.

Does Unity have a history of this kind of problem, of having apps rejected and pulled because of failure to meet platform requirements?

[chriszul]

@JeffDUnity3D

If you have Analytics enabled, it is recommended that you disable Analytics and attempt to publish again. If you are using Unity 2017, you’ll also want to disable HW Stats in the Player Settings. If you are using IAP (which requires Analytics), then you would want to disable Analytics at runtime with the following code:

https://docs.unity3d.com/ScriptReference/RuntimeInitializeOnLoadMethodAttribute.html

Analytics.initializeOnStartup = false;
Analytics.enabled = false;
PerformanceReporting.enabled = false;
Analytics.limitUserTracking = false;
Analytics.deviceStatsEnabled = false;

@JeffDUnity3D
I’m using unity 2020.1.b12, and my app has IAP so I used your above code snippet to make sure all analytics are turned off. It’s called using both of RuntimeInitializeLoadType.BeforeSplashScreen
and
RuntimeInitializeLoadType.SubsystemRegistration

This latest build of my app since the app was taken down has also been rejected by the play store saying the app collects personal information from children. The app collects no information and google have repeatedly ignored queries about what data they are detecting.

We’re not willing to say that we collect PII from children as that is not true and for a kid’s app is incredibly bad and would require verifiable consent from a parent. This is an extremely serious issue. Please update on any ideas as to how we can modify our app to prevent any and all access to PII in our app which the Unity engine is doing!

[Swah]

@JeffDUnity3D thanks for helping us figure this out. One of our app for kids was removed from the store as well.

We sent a new version which also got rejected. It is on 2017.4.40f1, has Unity IAP and therefore Analytics is enabled in the editor. We disable HW statistics and analytics at runtime as soon as we can:

[RuntimeInitializeOnLoadMethod(RuntimeInitializeLoadType.BeforeSceneLoad)]
static private void OnBeforeFirstSceneLoads()
{
/// prevent the transmission of any personal information such as IP address to Unity servers.
/// We can’t remove unity analytics entirely, because it is required for Unity’s IAP package.
Analytics.enabled = false;
Analytics.initializeOnStartup = false;
Analytics.limitUserTracking = true;
Analytics.deviceStatsEnabled = false;
PerformanceReporting.enabled = false;
}

Note that Analytics.limitUserTracking is set to true, as opposed to what Jeff wrote earlier in this post .

Is there anything else we can try under Unity 2017 to get accepted by Google? @CL-bburrage mentions a manifest fix, I’m assuming that can’t work for apps with IAP / Analytics?

[Aca]

@JuliusM

It shouldn’t be mentioned in the known issues section.

After being rejected because my app gathered data from children (Unity 5.6.0f3) I moved my project to 2019.4.1f1 and resubmitted the app to the play store again and I just received email from them that my app is again rejected… But this time they saying that my privacy policy is wrong but I’m using https://unity3d.com/legal/privacy-policy

Are there any privacy-policy which I can use for the app for 3+ children? I can’t write privacy-policy on my own.

Also I have tried _Adriaan solution and it didn’t worked too.

• I set “Does your app collect any personal and sensitive information?” to “Yes” in Store presence > App content > Target audience and content > App details.
• I adding the following to my privacy policy: “Unity, one of the game engines I use (for Hidden Folks, for instance), implements an interface on Android to request a device’s Android Device ID and the Advertising ID. I don’t use these interfaces in my games whatsoever, and have confirmed through tests that the data that could be requested from these interfaces never leaves your device.”

[chriszul]

So as it turned out, I did have to disclose in the play console that we collect personal data, as we do actually use device id for data security. I had the app updated to 2020.1.b12 and all analytics turned off too, so it’s unclear which thing was causing the problem really, maybe all of them. But it’s ok and republished now so thanks for the pointers @JeffDUnity3D .

[zapposh]

Same problem here. Premium game that uses or collects nothing external removed from Google Play, out of the blue.
From the above messages this issue does not seem to be fixed. ETA for 2019.4.x? (not upgrading to an unstable beta)

[Aca]

I can confirm that my app is accepted with Unity 2019.4.1f1 but also I’m using my own privacy policy now. Unity 2019.4.1f1 and Privacy Policy Hub together violate Families Policy requirements.

[lkmad]

When is 2018.4.24 going to be released with the fix? They just kicked out two more of my games.

[jerome-lacoste]

@Aca

I can confirm that my app is accepted with Unity 2019.4.1f1 but also I’m using my own privacy policy now. Unity 2019.4.1f1 and https://unity3d.com/legal/privacy-policy together violate Families Policy requirements.

Question: did you have to answer Yes to the question: “Does your app collect any personal and sensitive information?”

Or was adjusting your privacy policy sufficient?

Thanks

[altepTest]

How this page works?

Unity 2019.4.1

It says in the "
Known Issues in 2019.4.1f1"

that

Android: APK cannot be published to Google Play because Unity doesn’t meet the Families Policy Requirements (1246484)

but on clicking on the bug link it stated

Fixed in 2020.2.0a14, 2020.1.0b12, 2019.4.1f1, 2018.4.24f1

So is it fixed or not? What page have the precedence, the bug tracker page or the known issues page? I don’t want to download this version just to have a new lts version in two days available.

[Aca]

@jerome-lacoste

Question: did you have to answer Yes to the question: “Does your app collect any personal and sensitive information?”

Or was adjusting your privacy policy sufficient?

Thanks

I answered No.

[CanisLupus]

For the record, updating to Unity 2019.4.1f1 didn’t solve our problem, even though all analytics are disabled. This is probably because we are calling SystemInfo.deviceUniqueIdentifier to identify repeated usages of our app licenses so we don’t count them as being used in a different device (even though we hash the value and only use the first 5 bytes, they don’t know that).

However, Google has accepted 2 of our apps that also target kids, have analytics disabled, and use this identifier. Those apps in fact use Unity 2018.4.11f1, which doesn’t have the fix. Why? Right now we think this is due to those apps implementing a privacy policy acceptance screen on start.

So what we’re going to do now is implement that screen in the failing apps and see if they like it. It has been IMPOSSIBLE to get any response out of them. They take weeks to reply and when they do they say they can’t say what our app is sending via the network and that they can’t do anything. Incredibly frustrating.

[AcidArrow]

@CanisLupus

Those apps in fact use Unity 2018.4.11f1, which doesn’t have the fix.

Maybe the change to have the game always access user data was a recent Unity change.

[CanisLupus]

@AcidArrow

Maybe the change to have the game always access user data was a recent Unity change.

Possible, but we changed too many things in those apps to be sure of what fixed it. Hopefully tomorrow we’ll know if adding a privacy policy screen to the other apps was enough for Google.

[CanisLupus]

Update: No, adding a privacy policy screen was not enough for them. They still won’t tell us what is wrong, and this is infuriating.

UPDATE 2: We have two apps that are very similar, same target audience, same permissions, same settings on play store, uploaded with same Unity version, analytics disabled, privacy policy screen on startup, no personal information collection, both use the SystemInfo.deviceUniqueIdentifier but hashed and only the first 5 bytes of that hash. -----> One was rejected and the other wasn’t. They do whatever they want in the reviews and there’s no way to TALK to them. The back and forth from the form is a joke. It’s ridiculous!

[coshea]

@JuliusM

This was an issue for iOS, but it’s not an issue for Android. The detection happens when the Android ID or Advertising ID is accessed.

But my point is, if you aren’t using analytics or any plugins that do, you are still getting rejected, as per Adrian post above and also this thread

Coppa app rejected! Google Play Store detects Android DeviceID and Advertising ID even in empty app!

Hi, We have many apps that are which are in the child directed and which we are distributing over Google Play Store. Now google play has changed something on their Familes Policy Requirements. So when we upload an app Google allways tells us that they have detected that the app collects personal sensitive information: Android Device ID Advertising ID Now, we tried to upload an app which is completelly empty. All packages have been removed. No services active.We testet on Unity 2017.4 LTS an…

So is Unity accessing the androidid and ad id, even if you aren’t using it, in the same way that the code was active on iOS even if not used?