Is my app or its dependencies violating the Android Advertising Id policy?

Question

I've just received this message from Google Play but I'm not collecting the Advertising ID.

Reason for warning: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement

Google Play requires developers to provide a valid privacy policy when the app requests or handles sensitive user or device information. We’ve identified that your app collects and transmits the Android advertising ID, which is subject to a privacy policy requirement.

Is it possible any of my dependencies uses it? Here's the list of dependencies:

implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
implementation "org.jetbrains.anko:anko-common:$anko_version"

implementation ("com.android.support:appcompat-v7:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
    exclude group: 'com.android.support', module: 'design'
}
implementation ("com.android.support:design:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
}
implementation ("com.android.support:cardview-v7:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
    exclude group: 'com.android.support', module: 'design'
}
implementation 'com.github.PhilJay:MPAndroidChart:v3.0.2'
implementation 'com.github.apl-devs:appintro:v4.2.3'
implementation('com.crashlytics.sdk.android:crashlytics:2.6.8@aar') {
    transitive = true
}
implementation 'com.firebase:firebase-jobdispatcher:0.7.0'
implementation ("com.google.firebase:firebase-firestore:$firestore_version") {
    exclude group: 'com.google.firebase', module: 'firebase-auth'
}
implementation ("com.google.firebase:firebase-auth:$firebase_version") {
    exclude group: 'com.google.firebase', module: 'firebase-firestore'
}
implementation ("com.google.firebase:firebase-storage:$firebase_version") {
    exclude group: 'com.google.firebase', module: 'firebase-firestore'
}
implementation ('com.google.android.gms:play-services-auth:16.0.0') {
    exclude group: 'com.google.firebase', module: 'firebase-firestore'
}
implementation 'com.android.support.constraint:constraint-layout:1.1.3'
implementation 'com.android.support:multidex:1.0.3'
implementation ("com.android.support:exifinterface:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
    exclude group: 'com.android.support', module: 'design'
}
implementation 'com.soundcloud.android:android-crop:1.0.1@aar'
implementation 'com.github.bumptech.glide:glide:4.7.1'

Answer 1

Disable advertising id collection

According to the Firebase docs you can disable advertising id collection by setting:

<meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />

in your AndroidManifest.xml under the <Application> tag.

EDIT: It seems like people are having mixed success with this approach. Try adding configurations { all*.exclude group: 'com.google.firebase', module: 'firebase-core' all*.exclude group: 'com.google.firebase', module: 'firebase-iid' } to the Gradle app dependencies area as per comment below.

Answer 2

Today many developers are getting this same issue. I also got this issue. I didn't collect any sensitive data, I am not even showing ads to my users. In your case the Crashlytics lib could be an issue. It deals with advertising IDs. In the mail they mention the required action:

Action required: Add a privacy policy to your store listing and app

So I think all of us should add a privacy policy on the store listing as well as on the app. Before taking the action we should go through the related privacy policy. Here are some links from where you can get help:

Privacy policy to upload an app

Usage of Android Advertising ID

Developer Distribution Agreement

Developer Program Policies

Answer 3

You are using crashlytics below 2.9.3. Apparently it's collecting and sending the google advertising id as a key in their header. That might be the or one of the issues. You can check if it's sending the advertising id through a proxy like Charles.

Edit *** It seems that version 2.9.3 and above are still getting the advertisingID from by calling AdvertisingIdClient.getAdvertisingIdInfo() from the com.google.android.gms.ads.identifier package. I checked it by setting a break point on the method. I am assuming it is somehow still being send to fabric. Which would mean updating to higher version will not solve it..

Answer 4

For Unity users, the problem is in Unity Analytics.

To resolve this problem, we need to do 2 tasks:

• In Google Play Console, add the link: https://unity3d.com/legal/privacy-policy into Privacy Policy field in Store presence / Store listing
• In your app, add a Privacy Policy button by using the Unity's own plugin Unity Data Privacy Plug-in: https://assetstore.unity.com/packages/add-ons/services/unity-data-privacy-plug-in-118922

After resubmitted about some minutes, Google Play approved my app.

Answer 5

I am not using Crashlytics or any other thing. Just a simple offline app with Facebook Ads. Still my app was removed from the Play Store.

Issue: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement

Issue Description: Google Play requires developers to provide a valid privacy policy when the app requests or handles sensitive user or device information. We’ve identified that your app collects and transmits the Android advertising identifier, which is subject to a privacy policy requirement. If your app collects the Android advertising ID, you must provide a valid privacy policy in both the designated field in the Play Console, and from within the app.

Solution:

1. I created a Privacy Policy for my app using this link and edited it according to my app.

2. I created a url for my privacy policy using this link.

3. Log in to Google Play Console and Go to the Store presence and then store listing and paste your url in Privacy Policy section.

4. Submit your update.

Note - In my case I did not have to submit any new build with privacy policy as mentioned in mail and my app was visible in play store within hours I did the steps I mentioned above. If in case your app is not visible in play store after following the above points then you should put one privacy policy section in your app too and submit a new build.

Answer 6

I also recieved the same message and got some of my apps suspended today.

So i just deleted those three firebase dependencies:

compile 'com.google.firebase:firebase-core:10.0.1'
compile 'com.google.firebase:firebase-ads:10.0.1'
compile 'com.google.firebase:firebase-appindexing:10.0.1'

Then, i re-submitted the apps, and they was accepted after review :)

Answer 7

If your app uses Firebase SDKs like analytics and all, you can disable Advertising ID collection on SDK level by putting the following line in your AndroidManifest.xml file under the Application tag.

<meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />

You can read more about it here.

My app was not even an ad supported application but still it got hit by this section 4.8 clause. By employing the above technique I was able to get it back on Google Play without submitting any privacy policy.

Answer 8

this is the cause Google Play Services version 4.0 introduced new APIs and an ID for use by advertising and analytics providers. We need to provide a privacy statement and make it available on the web. For a sample go https://digital.com/blog/best-privacy-policy-generators/

To change settings on your android app. Developer Console, Store Listing, scroll down to Privacy Policy. Add the url here.

Answer 9

copied from google mail

Please contact policy support team.

1. If your app requests user data or makes sensitive permissions requests such as Phone, Accounts, Contacts, Camera, Microphone, or if your app uses the Android advertising identifier, you'll need to add a valid privacy policy in two places: your app's Store Listing page (instructions below) and within your app.
2. As a second option, you can remove any requests for user data or sensitive permissions. For example, you would need to remove {copy and paste permissions here} from the manifest. You will not need to add a privacy policy if you remove these requests. If you cannot complete steps 1 or 2, you'll need to unpublish the app from the Play Store.
3. If your app is already unpublished, you don’t need to take action unless you re-publish the app in the future.

You can follow these steps to add a privacy policy to your Store Listing:

1. Sign in to your Play Console.

2. Select your app.

3. On the left side, select Store presence > Store listing.

4. Under "Privacy Policy," enter the URL where you have the privacy policy hosted online.

5. Save your changes to submit the update to your app.

Please visit our help center for more information about Google Play privacy policy requirements.

Answer 10

Disabling Advertising ID collection:

https://firebase.google.com/support/guides/disable-analytics#disable_advertising_id_collection

via those two lines in Manifest file:

<meta-data android:name="firebase_analytics_collection_deactivated" android:value="true" />

<meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />

Answer 11

my app deleted from store today .. same issue all i do that i add privacy policy to the app from(App console - Store presence - Store listing) Like the image you can create it from App Privacy Policy Generator and uplaod it and write the link in Store listing and resubmit the app That is work for me and sorry for my bad language

Answer 12

I am using Crashlytics and OneSignal. Relying on @RikvanVelzen tests with Crashlytics 2.9.3, it is not the reason for my getting the messasge from Google, but OneSignal.

Google requirement is "you must provide a valid privacy policy in both the designated field in the Play Console, and from within the app."

Therefore, I believe that I need to do only two things which are not too complicated:

1. Add a privacy policy link from Google Play's console, to a webpage with the info
2. Add privacy policy info in the app

The following seems to provide instructions on how to do it (just one of many): https://www.iubenda.com/blog/warning-google-play-developer-policy-violation-action-required-policy-issue/

Answer 13

Privacy policy webpage creation:

• First, create a page with the privacy policy of the blocked application.
• Write what information you process. If you do not process private data, write it clearly.
• Add information (link) about app privacy policy in Google Play Console

App update with consent:

• Follow the instruction from Google website: https://developers.google.com/admob/android/eu-consent

• Add link to your privacy policy:
  privacyUrl = new URL("https://www.your.com/privacyurl"); ConsentForm form = new ConsentForm.Builder(context, privacyUrl)

• Add the privacy policy webpage by opening it in browser or in webview in your application

• Update app with consent and upload on Google Play Console

Answer 14

I had one of my app removed and another got warning for reason given as Issue: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement

I created the privacy policies for both the apps, updated the link in play console store listing, included privacy policy link in main menu of both apps and resubmitted apps. Both the apps are now live and running . If you need you can copy the policy, make sure to do edits according to your app permissions and name. Privacy policy

I don't know if these play console removal and warning count as strike, or somebody can enlighten me.

Answer 15

step 1 : add privacy and policy url to play store console

step 2 : create a button example in side bar when button clicked just call this below method and add your url here

private void callThisMethodWhenPrivacyButtonClicked() {
        AlertDialog.Builder alert = new AlertDialog.Builder(this);
        alert.setTitle("Title here");

        WebView wv = new WebView(this);
        wv.loadUrl("{your privacy and policy uurl }");
        wv.setWebViewClient(new WebViewClient() {
            @Override
            public boolean shouldOverrideUrlLoading(WebView view, String url) {
                view.loadUrl(url);

                return true;
            }
        });

        alert.setView(wv);
        alert.setNegativeButton("Close", new DialogInterface.OnClickListener() {
            @Override
            public void onClick(DialogInterface dialog, int id) {
                dialog.dismiss();
            }
        });
        alert.show();
    }

Answer 16

First, you have to create a privacy policy URL and then add this URL in GOOGLE PUBLISHER CONSOLE based on application. You can easily create privacy policy using this website.

Privacy Policies

If you have a server/host try to upload privacy policy page on your own server otherwise you can use this website for storing.

Mentioned: you have to add this policy page on your application. Create a menu as privacy police and show all your policy content on a dialog. Easiest way.

Answer 17

I received a warning from Google recently mentioning that I have violated the Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement.

I dont use ads on my app , but I am tracking users events / analytics using Amplitude and Fabric , which might be the cause of this warning.

Action required to solve the problem:

1. Generate privacy policy using Firebase app privacy policy generator

2. Include your generated privacy policy into your app , and make it accessible to users.

3. Update the app, and add privacy policy link (via Web page, or Google doc) to your store listing.

Answer 18

The issue states the violation is due to using user's Android Advertising ID. I had the same problem. I created a privacy policy and added the url to that in my app and to the Google Play page. Submitted an update and the App is live again. Make sure to mention that you are collecting a personally identifiable information, Android Advertising ID, in your app. I've given a link to my app's privacy policy, refer to that if you need to know how exactly it is mentioned.

This is my privacy policy:

https://nwsty.com/privacy-policy-and-terms-of-use-android/

You can easily create a privacy policy here:

https://app-privacy-policy-generator.firebaseapp.com/

Just for reference, this is the app in question: https://play.google.com/store/apps/details?id=com.instancea.nwsty&hl=en_US

Answer 19

I got 3 apps suspended today. I had a busy day but managed to start working on the apps after lunch. I worked on and submitted 2 updates out of 3. Now I'm working on the third one.

A few minutes ago, one just got approved. Most of my apps already have privacy policies. The ones that got suspended did not. The suspect libraries in my case are Admob and Firebase Analytics.

What I did: 1. I created a privacy policy web-page and added a link in the Google Play Store listing. 2. I added the privacy policy as a string in the app and it pops up via a dialog the user can accept or decline one time.

After the updates, I held my breath for 2 hours and voila!