What are the Google developer policies and agreements on tracking and ad policies?

[SebastianZimmeck]

As discussed today, @n-aggarwal and @wesley-tan, can you look into the various Google developer policies so that we understand exactly what is allowed and what is prohibited? This analysis will also inform us to which extent declining tracking is similar to enabling GPC, as you brought up this comparison today, @n-aggarwal. Here is an initial starting point; there may be more documents. So, take a look around.

• Google Play Policies start page
• Google Play content policy
• Google Play Developer API Terms of Service
• Google Play Developer Distribution Agreement
• Developer Program Policy
• Privacy, Deception and Device Abuse - User Data
• Monetization and Ads - Ads

[SebastianZimmeck]

Especially, to which extent are developers allowed to use alternative tracking techniques (e.g., device fingerprinting, using the MAC address of a device or other consistent identifier)?

[wesley-tan]

This specific link is useful for this https://developer.android.com/training/articles/user-data-ids

• MAC addresses are globally unique, not user-resettable, and survive factory resets. For these reasons, to protect user privacy, on Android versions 6 and higher, access to MAC addresses is restricted to system apps. Third-party apps can't access them. Doing further searching system apps are apps that are under /system/apps, like Google Play, Google Chrome, Settings etc, usually preinstalled onto your phone upon purchase.
• The most straightforward solution to identifying an app instance running on a device is to use a Firebase installation ID (FID), and this is the recommended solution in the majority of non-ads use cases. Only the app instance for which it was provisioned can access this identifier, and it's (relatively) easily resettable because it only persists as long as the app is installed. As a result, FIDs provide better privacy properties compared to non-resettable, device-scoped hardware IDs. n cases where an FID isn't practical, you can also use custom globally-unique IDs (GUIDs) to uniquely identify an app instance. The simplest way to do so is by generating your own GUID using the following code: String uniqueID = UUID.randomUUID().toString(); Because the identifier is globally unique, it can be used to identify a specific app instance.

[SebastianZimmeck]

For ad use cases, can any other identifier than the AdID be used? I think the answer is no. Non-ad use cases are not of interest to us.