The Android SDK and the Google Play's Data Safety Section

Google Play requires Android mobile app developers to provide their end users information about the data their app may collect and how that data is linked or possibly used to track their activity.

It is required that OneTrust customers prepare this information about their mobile app's privacy uses, their organization's intended purposes, and any integrated third-party vendors. The tables below outline how OneTrust SDKs are prepared to meet Google Play's newest privacy standards for mobile apps:

Note:

Mobile app developers using Google Play are required to submit this information by the April 2022 deadline. For more information, see Google's Developer site.

About OneTrust SDK Offerings

The Android SDK has the ability to:

  • Send user consent data to OneTrust servers when configured by the customer.

  • Link the user consent data to an anonymous OR customer-provided identifier.

Using Consent Logging & User Profiles

OneTrust SDKs save user consent only on the device by default. However, if a customer wants to log consent to OneTrust servers, they can do so by enabling the Capture Records of Consent setting in Geolocation Rules. This functionality is completely optional.

When Capture Records of Consent is enabled, the OneTrust SDKs, by default, generates a consent receipt using a randomized identifier and a user's consent is recorded against that randomized identifier each time the user updates their consent choices. If a customer wants to record a consent receipt using a known identifier, the SDK supports that as well, but this is completely optional. Depending on the implementation, a known identifier could be classified as personal data if the customer decides to use something such as: Email, Phone Number, Name, Device Id, etc.

When Capture Records of Consent is enabled, the OneTrust SDKs can also support the creation / update of a User Profile each time a user updates their consent choices on the device. A User Profile can store both consent data and custom data elements to enrich the profile. This functionality is completely optional.

To create and manage User Profiles in OneTrust, a customer will need to take the following actions with the SDK:

  • Provide an identifier to the SDK to create and link a User Profile.

  • Enable the Should Create Profile SDK setting which will create and update the User Profile anytime a user's consent changes.

Data Linked to Users

Privacy Protections

YES / NO

Does your app collect or share any of the required user data types?

Is all of the user data collected by your app encrypted in transit?

Do you provide a way for users to request that their data is deleted?

Types of Data

Personal Information

Name

This is situational based on the implementation of OneTrust SDK, but NO by default.

The value is not automatically collected by the SDK. However, an application can provide this information as the identifier for creating a User Profile in OneTrust.

Email Address

This is situational based on the implementation of OneTrust SDK, but NO by default.

The value is not automatically collected by the SDK. However, an application can provide this information as the identifier for creating a User Profile in OneTrust.

Personal Identifiers

This is situational based on the implementation of OneTrust SDK, but NO by default.

The value is not automatically collected by the SDK. However, an application can provide this information as the identifier for creating a User Profile in OneTrust.

Address

N/A

Phone Number

This is situational based on the implementation of OneTrust SDK, but NO by default.

The value is not automatically collected by the SDK. However, an application can provide this information as the identifier for creating a User Profile in OneTrust.

Race and ethnicity

N/A

Political or religious beliefs

N/A

Sexual orientation

N/A

Other personal info

N/A

Financial Information

Purchase history

N/A

Credit info

N/A

Credit card, debit card, or bank account number

N/A

Other financial info

N/A

Location

Approximate location

The SDK auto-computes the country and region code of the user via IP Address lookup. This is done so the SDK can deliver a CMP experience tailored for the user's jurisdiction. The SDK does not use any of the device's GPS location tracking services.

By default, the SDK does not send or store any location information on OneTrust servers. However, if a customer chooses to enable the Capture Records of Consent > Advanced Analytics feature in Geolocation Rules, the SDK will add the user's Country code to the Consent Receipt.

Precise location

N/A

Web browsing

Web browsing history

N/A

Messages

Emails

N/A

SMS or MMS Messages

N/A

Other in-app messages

N/A

Photos and videos

Photos

N/A

Videos

N/A

Audio Files

Voice or sound recordings

N/A

Music files

N/A

Other audio files

N/A

Health and fitness

Health information

N/A

Fitness information

N/A

Contacts

Contacts

N/A

Calender

Calendar Events

N/A

App info and performance

Crash logs

N/A

Diagnostics

N/A

Other app performance data

N/A

Files and docs

Files and docs

N/A

Other Types Not Mentioned

Page views and taps in app

N/A

In-app search history

N/A

Installed apps

N/A

Other actions

User interaction with the OneTrust SDK is recorded and the transaction is stored on OneTrust servers. This information is only captured when the Capture Records of Consent > Advanced Analytics setting is enabled in Geolocation Rules.

Device or other identifiers

Device or other identifiers

This is situational based on the implementation of OneTrust SDK, but NO by default.

The value is not automatically collected by the SDK. However, an application can provide this information as the identifier for creating a User Profile in OneTrust.

Data Collection

Actions on Data Collected

Description

Notes

Is this data collected, shared or both?

This data is transmitted off the user's device, either to you (the developer) or a third party. This includes data that is process ephemerally, or stored for longer.

The application can send user data from the user's device to the OneTrust server where data is stored for auditing purposes. Data is also always collected and stored locally on the device. Additionally, data can at times be shared if the publisher has enabled the Capture Records of Consent setting.

Is this data processed ephemerally?

Processed ephemerally means that the data is only stored in memory, and is retained for no longer than necessary to service the specific request in real-time, and not used for any other purpose.

Data collected in this way must still be disclosed, but will not be shown to users on your store listing.

OneTrust does store data in memory and it's only retained for as long as the OneTrust CMP SDK service is collecting consent from a user and is only used and stored for that purpose.

Is this data required for your app, or can users choose whether it's collected?

Users can choose whether this data is collected.

Consent logging is optional by default.

Why is this user data collected?

Fraud prevention, security, and compliance.

Data collected and stored on the device in memory is essential for providing a privacy compliant experience to the user.

Data shared with OneTrust via Capture Records of Consent and Advanced Analytics may be considered essential or non-essential depending on the publisher. This data is usually shared to OneTrust for Compliance and Analytics purposes.