Is my app or its dependencies violating the Androi

Question

I've just received this message from Google Play but I'm not collecting the Advertising ID.

Reason for warning: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement

Google Play requires developers to provide a valid privacy policy when the app requests or handles sensitive user or device information. We’ve identified that your app collects and transmits the Android advertising ID, which is subject to a privacy policy requirement.

Is it possible any of my dependencies uses it? Here's the list of dependencies:

implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
implementation "org.jetbrains.anko:anko-common:$anko_version"

implementation ("com.android.support:appcompat-v7:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
    exclude group: 'com.android.support', module: 'design'
}
implementation ("com.android.support:design:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
}
implementation ("com.android.support:cardview-v7:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
    exclude group: 'com.android.support', module: 'design'
}
implementation 'com.github.PhilJay:MPAndroidChart:v3.0.2'
implementation 'com.github.apl-devs:appintro:v4.2.3'
implementation('com.crashlytics.sdk.android:crashlytics:2.6.8@aar') {
    transitive = true
}
implementation 'com.firebase:firebase-jobdispatcher:0.7.0'
implementation ("com.google.firebase:firebase-firestore:$firestore_version") {
    exclude group: 'com.google.firebase', module: 'firebase-auth'
}
implementation ("com.google.firebase:firebase-auth:$firebase_version") {
    exclude group: 'com.google.firebase', module: 'firebase-firestore'
}
implementation ("com.google.firebase:firebase-storage:$firebase_version") {
    exclude group: 'com.google.firebase', module: 'firebase-firestore'
}
implementation ('com.google.android.gms:play-services-auth:16.0.0') {
    exclude group: 'com.google.firebase', module: 'firebase-firestore'
}
implementation 'com.android.support.constraint:constraint-layout:1.1.3'
implementation 'com.android.support:multidex:1.0.3'
implementation ("com.android.support:exifinterface:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
    exclude group: 'com.android.support', module: 'design'
}
implementation 'com.soundcloud.android:android-crop:1.0.1@aar'
implementation 'com.github.bumptech.glide:glide:4.7.1'

Answer 1

You are using crashlytics below 2.9.3. Apparently it's collecting and sending the google advertising id as a key in their header. That might be the or one of the issues. You can check if it's sending the advertising id through a proxy like Charles.

Edit *** It seems that version 2.9.3 and above are still getting the advertisingID from by calling AdvertisingIdClient.getAdvertisingIdInfo() from the com.google.android.gms.ads.identifier package. I checked it by setting a break point on the method. I am assuming it is somehow still being send to fabric. Which would mean updating to higher version will not solve it..

Answer 2

Privacy policy webpage creation:

• First, create a page with the privacy policy of the blocked application.
• Write what information you process. If you do not process private data, write it clearly.
• Add information (link) about app privacy policy in Google Play Console

App update with consent:

• Follow the instruction from Google website: https://developers.google.com/admob/android/eu-consent

• Add link to your privacy policy:
  privacyUrl = new URL("https://www.your.com/privacyurl"); ConsentForm form = new ConsentForm.Builder(context, privacyUrl)

• Add the privacy policy webpage by opening it in browser or in webview in your application

• Update app with consent and upload on Google Play Console

Answer 3

For Unity users, the problem is in Unity Analytics.

To resolve this problem, we need to do 2 tasks:

• In Google Play Console, add the link: https://unity3d.com/legal/privacy-policy into Privacy Policy field in Store presence / Store listing
• In your app, add a Privacy Policy button by using the Unity's own plugin Unity Data Privacy Plug-in: https://assetstore.unity.com/packages/add-ons/services/unity-data-privacy-plug-in-118922

After resubmitted about some minutes, Google Play approved my app.

Answer 4

I got 3 apps suspended today. I had a busy day but managed to start working on the apps after lunch. I worked on and submitted 2 updates out of 3. Now I'm working on the third one.

A few minutes ago, one just got approved. Most of my apps already have privacy policies. The ones that got suspended did not. The suspect libraries in my case are Admob and Firebase Analytics.

What I did: 1. I created a privacy policy web-page and added a link in the Google Play Store listing. 2. I added the privacy policy as a string in the app and it pops up via a dialog the user can accept or decline one time.

After the updates, I held my breath for 2 hours and voila!

Answer 5

I am using Crashlytics and OneSignal. Relying on @RikvanVelzen tests with Crashlytics 2.9.3, it is not the reason for my getting the messasge from Google, but OneSignal.

Google requirement is "you must provide a valid privacy policy in both the designated field in the Play Console, and from within the app."

Therefore, I believe that I need to do only two things which are not too complicated:

1. Add a privacy policy link from Google Play's console, to a webpage with the info
2. Add privacy policy info in the app

The following seems to provide instructions on how to do it (just one of many): https://www.iubenda.com/blog/warning-google-play-developer-policy-violation-action-required-policy-issue/

Answer 6

I am not using Crashlytics or any other thing. Just a simple offline app with Facebook Ads. Still my app was removed from the Play Store.

Issue: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement

Issue Description: Google Play requires developers to provide a valid privacy policy when the app requests or handles sensitive user or device information. We’ve identified that your app collects and transmits the Android advertising identifier, which is subject to a privacy policy requirement. If your app collects the Android advertising ID, you must provide a valid privacy policy in both the designated field in the Play Console, and from within the app.

Solution:

1. I created a Privacy Policy for my app using this link and edited it according to my app.

2. I created a url for my privacy policy using this link.

3. Log in to Google Play Console and Go to the Store presence and then store listing and paste your url in Privacy Policy section.

4. Submit your update.

Note - In my case I did not have to submit any new build with privacy policy as mentioned in mail and my app was visible in play store within hours I did the steps I mentioned above. If in case your app is not visible in play store after following the above points then you should put one privacy policy section in your app too and submit a new build.