0

One of my apps was recently removed from Google Play because they found that I was collecting ANDROID_ID, aka the Android ID advertising identifier without a privacy policy. I was using it for something trivial, so I removed it from the code, and re-submitted. It was approved but then later taken down again for the same reason.

They are now telling me that my app is collecting and using the advertising identifier through https://app-measurement.com/a. Clearly, it is being used in one of the libraries I am using as part of my build. Searching the project in Android Studio for "android_id" or app-measurement comes up with nothing relevant.

How can I find the uses of android_id in the project for myself and figure out what part of my code (what library) is to blame?

Flyview
  • 1,899
  • 1
  • 28
  • 46
  • this is quite a hypothetical question, because private methods could be obfuscated. – Martin Zeitler Apr 11 '19 at 19:17
  • I am going to write how I resolved this here but not making it an answer because it wasn't a real solution. After googling app-measurement I found most questions around it revolved around firebase. After looking through my libraries, the only thing that seemed to use firebase was the "App invites" Google library. I removed that, app stopped compiling firebase, and the problem went away. – Flyview Apr 16 '19 at 03:49
  • How did you find it? By listing all your app dependencies? I'm in the same case, advertising id is sent to app-measurement.com. I think it is related to Crashlytics because it is the only Firebase lib I'm using. I explicitly disabled advertising ID in the manifest but it's not working, my app has been removed again. Maybe there is another option in Firebase documentation... – glucas Apr 18 '19 at 07:38
  • @glucas What's hilarious is Firebase is Google's own library doing this. I just noticed that firebase was listed under "External libraries" in Android Studio. It was not a direct dependency in the gradle file. I then guessed it was the app-invite library that needed it and I was right. You may be better off just writing up a privacy policy and saying you collect it for xx service. – Flyview Apr 19 '19 at 20:09

0 Answers0