199

I've just received this message from Google Play but I'm not collecting the Advertising ID.

Reason for warning: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement

Google Play requires developers to provide a valid privacy policy when the app requests or handles sensitive user or device information. We’ve identified that your app collects and transmits the Android advertising ID, which is subject to a privacy policy requirement.

Is it possible any of my dependencies uses it? Here's the list of dependencies:

implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
implementation "org.jetbrains.anko:anko-common:$anko_version"

implementation ("com.android.support:appcompat-v7:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
    exclude group: 'com.android.support', module: 'design'
}
implementation ("com.android.support:design:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
}
implementation ("com.android.support:cardview-v7:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
    exclude group: 'com.android.support', module: 'design'
}
implementation 'com.github.PhilJay:MPAndroidChart:v3.0.2'
implementation 'com.github.apl-devs:appintro:v4.2.3'
implementation('com.crashlytics.sdk.android:crashlytics:2.6.8@aar') {
    transitive = true
}
implementation 'com.firebase:firebase-jobdispatcher:0.7.0'
implementation ("com.google.firebase:firebase-firestore:$firestore_version") {
    exclude group: 'com.google.firebase', module: 'firebase-auth'
}
implementation ("com.google.firebase:firebase-auth:$firebase_version") {
    exclude group: 'com.google.firebase', module: 'firebase-firestore'
}
implementation ("com.google.firebase:firebase-storage:$firebase_version") {
    exclude group: 'com.google.firebase', module: 'firebase-firestore'
}
implementation ('com.google.android.gms:play-services-auth:16.0.0') {
    exclude group: 'com.google.firebase', module: 'firebase-firestore'
}
implementation 'com.android.support.constraint:constraint-layout:1.1.3'
implementation 'com.android.support:multidex:1.0.3'
implementation ("com.android.support:exifinterface:$android_support_version") {
    exclude group: 'com.android.support', module: 'animated-vector-drawable'
    exclude group: 'com.android.support', module: 'design'
}
implementation 'com.soundcloud.android:android-crop:1.0.1@aar'
implementation 'com.github.bumptech.glide:glide:4.7.1'
10
  • 26
  • 3
    I've added a privacy policy using app-privacy-policy-generator.firebaseapp.com
    – aloj
    Sep 18, 2018 at 8:30
  • 3
    how did you confirm that you successfully stopped the violation after putting generated url?
    – giveJob
    Sep 18, 2018 at 15:51
  • 5
    Adding only privacy URL does not work they removed my app again on 2nd day after providing privacy URL we need to make code changes i believe still figuring out what code fix is needed
    – Bhavesh
    Sep 19, 2018 at 4:42
  • 2
    My app got kicked, I added a policy online... Got kicked again. I added a policy to the app itself... Got kicked again. Changed the policy to one from firebase specifically... Got kicked again. Changed the policy in app and online and filed a complaint... Went back up but there no follow up so I'm unsure why it was taken down. I like so many others here was only using firebase analytics. Game was in Unity3D. Not using any ads in the game. for reference, the game is lexicube.app
    – DKinnison
    Mar 12, 2019 at 18:06

19 Answers 19

72

Disable advertising id collection

According to the Firebase docs you can disable advertising id collection by setting:

<meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />

in your AndroidManifest.xml under the <Application> tag.

EDIT: It seems like people are having mixed success with this approach. Try adding configurations { all*.exclude group: 'com.google.firebase', module: 'firebase-core' all*.exclude group: 'com.google.firebase', module: 'firebase-iid' } to the Gradle app dependencies area as per comment below.

13
  • 1
    Out of morbid curiosity, how many ad libraries (and other fodder) did this crash because they assumed AdvertisingIdClient.getAdvertisingIdInfo() would always succeed?
    – jww
    Sep 19, 2018 at 9:34
  • 4
    This will not crash any other Ad libraries. It will only notify firebase to not collect the ad id. I am only using firebase messaging still firebase is collecting analytics and other stuff by default and I can see this on the console. Sep 19, 2018 at 11:29
  • 11
    I used this technique and my app got reinstated without submitting any privacy policy. Sep 22, 2018 at 0:18
  • 26
    so nice of google to kick my app out of the store with no warning for using firebase, way to go google
    – ninj4 n00b
    Sep 27, 2018 at 5:23
  • 2
    It's not the solution. In my case I added this line and republish. After some days, my app was kick out again from google play.
    – Juan Pablo
    Oct 11, 2018 at 18:55
58

Today many developers are getting this same issue. I also got this issue. I didn't collect any sensitive data, I am not even showing ads to my users. In your case the Crashlytics lib could be an issue. It deals with advertising IDs. In the mail they mention the required action:

Action required: Add a privacy policy to your store listing and app

So I think all of us should add a privacy policy on the store listing as well as on the app. Before taking the action we should go through the related privacy policy. Here are some links from where you can get help:

Privacy policy to upload an app

Usage of Android Advertising ID

Developer Distribution Agreement

Developer Program Policies

6
  • 29
    ...or don't use Crashlytics, or any other dependency that may be violating people's privacy. I believe this is now illegal in Europe anyway, and the fines are potentially huge. If you use services that may be siphoning away people's private data, to which the id belongs, you put them (and your company) at risk.
    – Cerberus
    Sep 19, 2018 at 12:16
  • 7
    @Cerberus Using them is certainly not illegal, but you need to collect opt-in and fulfil additional requirements. Good on Google for enforcing this, actually (though they probably don’t do it out of the goodness of their heart). Sep 19, 2018 at 13:11
  • 4
    @KonradRudolph Should "meeting the minimum legal requirements" be the standard against which we decide if privacy is violated?
    – Juggerbot
    Sep 19, 2018 at 13:22
  • 4
    @Juggerbot It’s unclear whether Google has any legal requirement in this regard; they probably do it to cover their asses just in case but the infringing party in this case according to GDPR would be the app developer, not Google. Sep 19, 2018 at 13:27
  • Apple announced that from 3rd October every app owner have to add privacy policy. But our android!!!??? OMG
    – Mafujul
    Sep 20, 2018 at 10:22
22

You are using crashlytics below 2.9.3. Apparently it's collecting and sending the google advertising id as a key in their header. That might be the or one of the issues. You can check if it's sending the advertising id through a proxy like Charles.

Edit *** It seems that version 2.9.3 and above are still getting the advertisingID from by calling AdvertisingIdClient.getAdvertisingIdInfo() from the com.google.android.gms.ads.identifier package. I checked it by setting a break point on the method. I am assuming it is somehow still being send to fabric. Which would mean updating to higher version will not solve it..

4
  • 4
    How do you check?
    – Questioner
    Sep 18, 2018 at 9:04
  • @RikvanVelzen You mention version 2.9.3. Can you point to the info saying that in newer versions it is is not an issue?
    – Yossi
    Sep 18, 2018 at 9:17
  • 5
    @Yossi: no the only thing i can point to is the reddit post which link you can find in to comments of the question. And I checked myself through Charles that in 2.9.3 the X-CRASHLYTICS-ADVERTISING-TOKEN is not sent in the header anymore. Sep 18, 2018 at 9:21
  • 7
    Crashlytics does not send Advertising ID starting from 2.9.3. Mike from Fabric stated clearly: "From Crashlytics SDK version 2.9.3 and higher, we no longer submit the Android Ad Id to our servers. In prior versions of the Crashlytics SDK, this Id was primarily collected and submitted for Mobile App Conversion Tracking and Audience Insights (both of which are now deprecated features)." (reddit.com/r/androiddev/comments/9gqr6y/…)
    – javaxian
    Sep 19, 2018 at 7:55
20

For Unity users, the problem is in Unity Analytics.

To resolve this problem, we need to do 2 tasks:

After resubmitted about some minutes, Google Play approved my app.

7
  • 2
    In Unity 2018, can we remove the package of Unity Analytics and Ads to fix this too? Sep 19, 2018 at 20:40
  • @GabrielStafoca I think that it is possible, you can try it
    – Quang Tran
    Sep 20, 2018 at 22:54
  • Not if you're actually using the Analytics... ;)
    – Almo
    Sep 22, 2018 at 21:15
  • @GabrielStafoca that worked for me. I also added unity's privacy policy URL on store listing. Btw I wasn't using Unity Ads or Analytics. unity3d.com/legal/privacy-policy
    – Erdi
    Sep 23, 2018 at 8:59
  • @QuangTran you sure this will solve it in unity? the emails from google state..Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement Sep 24, 2018 at 17:52
16

I am not using Crashlytics or any other thing. Just a simple offline app with Facebook Ads. Still my app was removed from the Play Store.

Issue: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement

Issue Description: Google Play requires developers to provide a valid privacy policy when the app requests or handles sensitive user or device information. We’ve identified that your app collects and transmits the Android advertising identifier, which is subject to a privacy policy requirement. If your app collects the Android advertising ID, you must provide a valid privacy policy in both the designated field in the Play Console, and from within the app.

Solution:

  1. I created a Privacy Policy for my app using this link and edited it according to my app.

  2. I created a url for my privacy policy using this link.

  3. Log in to Google Play Console and Go to the Store presence and then store listing and paste your url in Privacy Policy section.

  4. Submit your update.

Note - In my case I did not have to submit any new build with privacy policy as mentioned in mail and my app was visible in play store within hours I did the steps I mentioned above. If in case your app is not visible in play store after following the above points then you should put one privacy policy section in your app too and submit a new build.

6
  • 1
    That's exactly the solution, I just had this problem last night, and I wrote a Privacy Policy and added the link to console, and now it's published again.
    – Stevie
    Sep 20, 2018 at 10:23
  • Were downloads affected after the app was brought back?
    – Sucho
    Sep 28, 2018 at 4:53
  • No. The downloads were same.
    – Imran
    Oct 1, 2018 at 4:47
  • Was your android app removed or you were given a warning? Oct 6, 2018 at 8:51
  • The app was removed but it came back once I put the privacy policy as explained in the answer.
    – Imran
    Oct 8, 2018 at 9:09
14

I also recieved the same message and got some of my apps suspended today.

So i just deleted those three firebase dependencies:

compile 'com.google.firebase:firebase-core:10.0.1'
compile 'com.google.firebase:firebase-ads:10.0.1'
compile 'com.google.firebase:firebase-appindexing:10.0.1'

Then, i re-submitted the apps, and they was accepted after review :)

7
  • resubmitted app now it is visible in play app store?
    – giveJob
    Sep 19, 2018 at 1:06
  • Yep, they are accepted en ligne again on Play Store.
    – Gama
    Sep 19, 2018 at 1:10
  • 8
    This is the only answer so far that shows how to stop collecting the information!
    – pipe
    Sep 19, 2018 at 1:45
  • 1
    What if my app is showing ads? Since you removed firebase-ads dependecy
    – olajide
    Sep 19, 2018 at 10:03
  • Firebase is just for tracking users interactions and analytics
    – Gama
    Sep 19, 2018 at 10:17
7

If your app uses Firebase SDKs like analytics and all, you can disable Advertising ID collection on SDK level by putting the following line in your AndroidManifest.xml file under the Application tag.

<meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />

You can read more about it here.

My app was not even an ad supported application but still it got hit by this section 4.8 clause. By employing the above technique I was able to get it back on Google Play without submitting any privacy policy.

1
  • I am not using firebase SDK but I am using Fabric so is it okay if i only add privacy policy section in my app and provide url in my console ?
    – bhaskar
    Oct 3, 2018 at 17:26
6

this is the cause Google Play Services version 4.0 introduced new APIs and an ID for use by advertising and analytics providers. We need to provide a privacy statement and make it available on the web. For a sample go https://digital.com/blog/best-privacy-policy-generators/

To change settings on your android app. Developer Console, Store Listing, scroll down to Privacy Policy. Add the url here.

4
  • How do you know it has to do with GPS 4.0+? How is that connected to the advertising ID violation? Sep 18, 2018 at 8:58
  • 1
    I did, but it's quite unclear if and how google play services uses the advertisingID and if there is a way to disable or opt-out of it. Are you 100% sure it's due to GPS 4.0+ and could you pinpoint to where the advertising ID is used/transmitted? Sep 18, 2018 at 9:26
  • 1
    as the text reads "Google Play Services version 4.0 introduced new APIs and an ID for use by advertising and analytics providers". I use crashlytics to collect crash details, admob (free version app) and Fabric to collect statistics so if any of these apply then you are apparantly transmitting an adversingId.
    – Theo
    Sep 18, 2018 at 9:32
  • Is it necessary that privacy policy URL should be a dedicated website? OR can we use some type of free blog for this purpose like blogger.com? Sep 19, 2018 at 17:34
6

copied from google mail

Please contact policy support team.

  1. If your app requests user data or makes sensitive permissions requests such as Phone, Accounts, Contacts, Camera, Microphone, or if your app uses the Android advertising identifier, you'll need to add a valid privacy policy in two places: your app's Store Listing page (instructions below) and within your app.
  2. As a second option, you can remove any requests for user data or sensitive permissions. For example, you would need to remove {copy and paste permissions here} from the manifest. You will not need to add a privacy policy if you remove these requests. If you cannot complete steps 1 or 2, you'll need to unpublish the app from the Play Store.
  3. If your app is already unpublished, you don’t need to take action unless you re-publish the app in the future.

You can follow these steps to add a privacy policy to your Store Listing:

  1. Sign in to your Play Console.

  2. Select your app.

  3. On the left side, select Store presence > Store listing.

  4. Under "Privacy Policy," enter the URL where you have the privacy policy hosted online.

  5. Save your changes to submit the update to your app.

Please visit our help center for more information about Google Play privacy policy requirements.

enter image description here

1
  • means no need update the apk?or just privacy url is enough?
    – giveJob
    Sep 18, 2018 at 15:58
6

Disabling Advertising ID collection:

https://firebase.google.com/support/guides/disable-analytics#disable_advertising_id_collection

via those two lines in Manifest file:

<meta-data android:name="firebase_analytics_collection_deactivated" android:value="true" />

<meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />
3

my app deleted from store today .. same issue all i do that i add privacy policy to the app from(App console - Store presence - Store listing) Like the image you can create it from App Privacy Policy Generator and uplaod it and write the link in Store listing and resubmit the app That is work for me and sorry for my bad language

2
  • 1
    how did you confirm that you successfully stopped the violation after putting generated url?
    – giveJob
    Sep 18, 2018 at 15:50
  • 1
    beware, you need to update your app as well, not just the link in Developer Console. From past experience, google do not notify that you are compliant. they will simply remove the app from the store again. I guess we just need to wait until the deadline has passed with crossed fingers.
    – Theo
    Sep 18, 2018 at 18:55
3

I am using Crashlytics and OneSignal. Relying on @RikvanVelzen tests with Crashlytics 2.9.3, it is not the reason for my getting the messasge from Google, but OneSignal.

Google requirement is "you must provide a valid privacy policy in both the designated field in the Play Console, and from within the app."

Therefore, I believe that I need to do only two things which are not too complicated:

  1. Add a privacy policy link from Google Play's console, to a webpage with the info
  2. Add privacy policy info in the app

The following seems to provide instructions on how to do it (just one of many): https://www.iubenda.com/blog/warning-google-play-developer-policy-violation-action-required-policy-issue/

3

Privacy policy webpage creation:

  • First, create a page with the privacy policy of the blocked application.
  • Write what information you process. If you do not process private data, write it clearly.
  • Add information (link) about app privacy policy in Google Play Console

App update with consent:

  • Follow the instruction from Google website: https://developers.google.com/admob/android/eu-consent
  • Add link to your privacy policy:
    privacyUrl = new URL("https://www.your.com/privacyurl"); ConsentForm form = new ConsentForm.Builder(context, privacyUrl)

  • Add the privacy policy webpage by opening it in browser or in webview in your application

  • Update app with consent and upload on Google Play Console
2
3

step 1 : add privacy and policy url to play store console

step 2 : create a button example in side bar when button clicked just call this below method and add your url here

private void callThisMethodWhenPrivacyButtonClicked() {
        AlertDialog.Builder alert = new AlertDialog.Builder(this);
        alert.setTitle("Title here");

        WebView wv = new WebView(this);
        wv.loadUrl("{your privacy and policy uurl }");
        wv.setWebViewClient(new WebViewClient() {
            @Override
            public boolean shouldOverrideUrlLoading(WebView view, String url) {
                view.loadUrl(url);

                return true;
            }
        });

        alert.setView(wv);
        alert.setNegativeButton("Close", new DialogInterface.OnClickListener() {
            @Override
            public void onClick(DialogInterface dialog, int id) {
                dialog.dismiss();
            }
        });
        alert.show();
    }
3

First, you have to create a privacy policy URL and then add this URL in GOOGLE PUBLISHER CONSOLE based on application. You can easily create privacy policy using this website.

Privacy Policies

If you have a server/host try to upload privacy policy page on your own server otherwise you can use this website for storing.

Mentioned: you have to add this policy page on your application. Create a menu as privacy police and show all your policy content on a dialog. Easiest way.

3

I had one of my app removed and another got warning for reason given as Issue: Violation of Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement

I created the privacy policies for both the apps, updated the link in play console store listing, included privacy policy link in main menu of both apps and resubmitted apps. Both the apps are now live and running . If you need you can copy the policy, make sure to do edits according to your app permissions and name. Privacy policy

I don't know if these play console removal and warning count as strike, or somebody can enlighten me.

4
  • Is not a strike, you get strike if you app is in "Suspended" status if you can upload again app, is not strike, is strike when you can´t upload again app. Sep 19, 2018 at 8:40
  • can you please tell me that Is it necessary that privacy policy URL should be a dedicated website? OR can we use some type of free blog for this purpose like blogger.com? Sep 19, 2018 at 17:36
  • @NoamanAkram As you can see i have used word press blog site, so it can be any url a s long it is public and works. You check the mail they have mentioned the points for url. Sep 20, 2018 at 1:01
  • thanks @user2983041 one of my app was removed ,obviously its not same as suspended so as i understood it is not counted as strike , right? What about update rejected for any policy violation, will it be counted or not ? Sep 20, 2018 at 1:04
2

I received a warning from Google recently mentioning that I have violated the Usage of Android Advertising ID policy and section 4.8 of the Developer Distribution Agreement.

I dont use ads on my app , but I am tracking users events / analytics using Amplitude and Fabric , which might be the cause of this warning.

Action required to solve the problem:

  1. Generate privacy policy using Firebase app privacy policy generator
  2. Include your generated privacy policy into your app , and make it accessible to users.

  3. Update the app, and add privacy policy link (via Web page, or Google doc) to your store listing.

0
2

The issue states the violation is due to using user's Android Advertising ID. I had the same problem. I created a privacy policy and added the url to that in my app and to the Google Play page. Submitted an update and the App is live again. Make sure to mention that you are collecting a personally identifiable information, Android Advertising ID, in your app. I've given a link to my app's privacy policy, refer to that if you need to know how exactly it is mentioned.

This is my privacy policy:

https://nwsty.com/privacy-policy-and-terms-of-use-android/

You can easily create a privacy policy here:

https://app-privacy-policy-generator.firebaseapp.com/

enter image description here

Just for reference, this is the app in question: https://play.google.com/store/apps/details?id=com.instancea.nwsty&hl=en_US

0

I got 3 apps suspended today. I had a busy day but managed to start working on the apps after lunch. I worked on and submitted 2 updates out of 3. Now I'm working on the third one.

A few minutes ago, one just got approved. Most of my apps already have privacy policies. The ones that got suspended did not. The suspect libraries in my case are Admob and Firebase Analytics.

What I did: 1. I created a privacy policy web-page and added a link in the Google Play Store listing. 2. I added the privacy policy as a string in the app and it pops up via a dialog the user can accept or decline one time.

After the updates, I held my breath for 2 hours and voila!

3
  • 2
    can you please share some code that will help us to make similar changes in everyone app how to add the privacy policy as a string in the app and it pops up via a dialog the user can accept or decline one time.
    – Bhavesh
    Sep 19, 2018 at 5:21
  • That might be a silly question but what are you doing in case the user declines the privacy policy by clicking the "Decline" button? Sep 20, 2018 at 19:26
  • Same thing that happens when you decline an EULA
    – zimspy
    Sep 22, 2018 at 11:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.