how to check if the SDKs in my app are collecting any Advertising ID

Question

Google sent me a warning to inform me about one of my apps collecting Android Device Id and Advertising ID informations. Is there any tool i can use to test which SDK is involved in this activity?

P.s: I'm using the following SDK: Admob mediation, Firebase, Onesignal

Thank you!

Answer 1

What I did was open the manifest of my app, click below on "merged manifest" and look for the SDK reading them all, there I could see that the dependency "play-services-ads-identifier:18.0.0" is involved in the activity which makes my app use advertising ID, I found out by opening that manifest and copying and pasting into Google search "com.google.android.gms.ads_identifier" which is the package that manifest refers to and then it took me here:

https://developers.google.com/android/reference/com/google/android/gms/ads/identifier/package-summary

I don't know if it's exactly your dependency but for me the only way to find out that I had was this.

Saludos!

Answer 2

First, check your Merged Manifest and look for the permission:

<uses-permission android:name="com.google.android.gms.permission.AD_ID" />

Double-click it to open the manifest file that it comes from, and check the file path in the newly opened tab name. In my case, the permission was coming from:

play-services-ads-identifier-18.0.0/AndroidManifest.xml

Then, open Code -> Analyze Code -> Dependencies... in Android Studio. A report will be generated listing all your dependencies and their included dependencies. In the search field in the top of your report, search for "play-services-ads-identifier" and click the entry that it finds.

Now, in the right window you can see all your dependencies that include this library.

In my case it was imported by firebase-analytics-ktx.

Answer 3

For my app, we do not collect the AAID, but were still getting flagged by Google Play for accessing or sending it somewhere in a dependency. I already added the permission removal statement in my manifest, and the AD_ID permission was not appearing in my merged manifest. Based off of Thomas Nielsen's answer, I looked into how to disable Firebase analytics' collection of the AAID:

Disable Advertising ID collection

If you wish to disable collection of the Advertising ID in your Android app, you can set the value of google_analytics_adid_collection_enabled to false in your app's AndroidManifest.xml in the application tag. For example:

<meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />