Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove code retrieving Hardware id #960

Open
chao2zhang opened this issue Jan 14, 2022 · 3 comments
Open

Remove code retrieving Hardware id #960

chao2zhang opened this issue Jan 14, 2022 · 3 comments

Comments

@chao2zhang
Copy link

SystemObserver is retrieving android.provider.Settings.Secure.ANDROID_ID. This seems to be violate User Data Privacy

Your app collects or links persistent device identifiers (e.g., IMEI, IMSI, SIM Serial #, etc.) | Persistent device identifiers may not be linked to other personal and sensitive user data or resettable device identifiers except for the purposes of Telephony linked to a SIM identity (e.g., wifi calling linked to a carrier account), and Enterprise device management apps using device owner mode.

This is a related change for segment SDK, announced in the documentation.

Note: From 4.10.1, Segment no longer collects the Android ID to comply with Google’s User Data Policy.

@jf-branch
Copy link
Contributor

Hi @chao2zhang, I apologize for the delayed response, the Branch Product, Engineering, and Legal teams are discussing this further. We will have a formal stance and update shortly.

@chao2zhang
Copy link
Author

Is this going to be resolved by #974? SystemObserver still seems to be invoked with that PR.

@jf-branch
Copy link
Contributor

Hi @chao2zhang, that is correct. After further review, Branch is in compliance with Google's User Data Policy, as we do not link persisted device identifiers to other personal and sensitive user data, however, we drop it at point of ingestion server side. We understand server side handling is not enough, and therefore, that PR incorporates logic where we will no longer collect the SSAID when we have a valid GAID, however, when we are unable to collect the GAID, we will collect the SSAID, and that is in accordance with Google's User Data Policy.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants