facebook / facebook-android-sdk

Used to integrate Android apps with Facebook Platform.
https://developers.facebook.com/docs/android
Other
6.07k stars 3.64k forks source link

Automatic event fb_sdk_settings_changed collects private user data #1231

Open NewestUser opened 3 months ago

NewestUser commented 3 months ago

Checklist before submitting a bug report

Java version

11

Android version

API 33

Android SDK version

16.3.0

Installation platform & version

gradle

Package

Core & AppEvents

Goals

Remove health data violation warning in Events Manager. I received a report stating that the event fb_sdk_settings_changed with event parameter previous contains sensitive user data that violates the facebook policy.

Expected results

A mechanism or documentation on how to intercept this event and remove any sensitive data from it or be able to stop logging this event.

Actual results

I set the value to true of the following properties:

    <meta-data
      android:name="com.facebook.sdk.AutoLogAppEventsEnabled"
      android:value="true" />

    <meta-data
      android:name="com.facebook.sdk.AdvertiserIDCollectionEnabled"
      android:value="true" />

Steps to reproduce

No response

Code samples & details

My app uses a androidx.preference.PreferenceFragmentCompat to provide a preference screen in which the user can enter his age, current weight, height etc... Basically data that violates facebook's health data requirements. I am not logging any custom events. I suspect that the facebook sdk somehow detects changes in preferences and logs those changes in the events that it fires.