Children’s Advertising Review Unit Determines Development Platform Unity Did Not Have Actual Knowledge of Ad SDK Data Collection in Child-Directed Apps

703.247.9330 / press@bbbnp.org

McLean, VA – April 28, 2021 – The Children’s Advertising Review Unit (CARU), a division of BBB National Programs, determined that Unity Technologies did not have actual knowledge, as defined by the Children’s Online Privacy Protection Act (COPPA) and CARU’s Guidelines for Online Privacy Protection, that the company’s advertising software developer kit (Ads SDK) was collecting persistent identifiers from child-targeted apps Number Coloring and Cats and Cosplay.  

Initially brought to CARU’s attention through an investigation conducted by the International Digital Accountability Council (IDAC), Unity is a software platform that provides solutions to create, run, and monetize interactive real-time 2D and 3D content for mobile phones, tablets, PCs, consoles, and augmented and virtual reality devices.    

IDAC reported that certain versions of the Unity Ads SDK simultaneously collected the persistent identifiers AAID and Android ID from users. This dual collection would potentially allow companies to track users over time and across platforms for the purposes of behavioral advertising. In addition, using persistent identifiers in such a manner would constitute a breach of Google’s Play Store Policies. IDAC stated that the offending versions of the Unity Ads SDK were present in three mobile apps directed to children, namely Princess Salon, Number Coloring, and Cats and Cosplay. CARU was concerned that Unity had “actual knowledge” its Ads SDK collected information from children under 13 in violation of the COPPA Rule and CARU’s Guidelines.

CARU assessed Unity’s evidence to demonstrate whether it had policies, processes, and tools in place that allow app developers to indicate whether their app(s) are directed to children. Unity provides multiple opportunities for app developers to indicate an app is a “Child App” - during the initial Ads SDK set-up, in analytics or ad services activation, and in the developer dashboard - which would then prevent the collection of the AAID and Android ID by its Ads SDK. Unity also informs app developers of this requirement in its User Manual and enforces the requirement by way of its Terms of Service and related policies governing the use of the Unity Ads SDK. Finally, Unity asserted that it does not use the information it collects via a child-directed app for tracking or targeting purposes, including behavioral advertising, or any other purpose.

CARU also looked at proactive measures taken by Unity to rectify the misuse of its Ads SDK, including promptly flagging the Number Coloring and Cats and Cosplay apps as child-directed on its platform and taking steps to delete the personal information it had inadvertently collected from child users on those apps. Princess Salon was ultimately found not to be using Unity’s Ads SDK. Prior to CARU’s inquiry, Unity had updated its entire platform to prevent developers from accessing the AAID simultaneously with the Android ID to prevent similar concerns in the future.

CARU was pleased that Unity participated in CARU’s self-regulatory program and took steps to delete all personal information that it had inadvertently collected from children.

All BBB National Programs case decision summaries can be found in the case decision library. For the full text of NAD, NARB, and CARU decisions, subscribe to the online archive.

###

About BBB National Programs: BBB National Programs is where businesses turn to enhance consumer trust and consumers are heard. The non-profit organization creates a fairer playing field for businesses and a better experience for consumers through the development and delivery of effective third-party accountability and dispute resolution programs. Embracing its role as an independent organization since the restructuring of the Council of Better Business Bureaus in June 2019, BBB National Programs today oversees more than a dozen leading national industry self-regulation programs, and continues to evolve its work and grow its impact by providing business guidance and fostering best practices in arenas such as advertising, child-directed marketing, and privacy. To learn more, visit bbbprograms.org.

About the Children’s Advertising Review Unit: The Children’s Advertising Review Unit (CARU), a division of BBB National Programs and the nation’s first Safe Harbor Program under the Children’s Online Privacy Protection Act (COPPA), helps companies comply with laws and guidelines that protect children from deceptive or inappropriate advertising and ensure that, in an online environment, children's data is collected and handled responsibly. When advertising or data collection practices are misleading, inappropriate, or inconsistent with laws and guidelines, CARU seeks change through the voluntary cooperation of companies and where relevant, enforcement action.