How to implement a EULA to comply with Appodeal’s new privacy policy?

Solar2D Monetization (in-app purchases, ads, etc.)
#1

Appodeal sent an email earlier this week saying the following:

“Please note that GDPR compliance requires notifying the end users that their information is being collected. Our updated privacy policy sets out your responsibilities for making such disclosures to, and obtaining consent from, end users of your apps. As an app developer or publisher, by initializing our SDK you agree that you’re responsible for notifying the end users that you’re using Appodeal as a data collection-related SDK.”

So my question is: what is a good way to make sure I am complying with this new policy? Specifically, how would I word my EULA and (on Android) how would I present it to my users (as I understand it, Apple has a built in feature to show EULAs).

#2

You have to request consent. Displaying the auto EULA from Apple will not be sufficient for GDPR. I have quoted the Appodeal privacy policy as well as highlighted in bold the important part:

(e) Software Development Kit

To provide our Services, we offer a software development kit (“SDK”) which allows us to access your Mobile Properties. We may collect Personal Information about users of your Mobile Properties through our SDK, including IP addresses, mobile advertising IDs, GPS location (if appropriate permission is given), application usage statistics such as launch times and duration, ad views and click-throughs. Advertisers or demand partners that provide content through our SDK may also collect Personal Information or other information about your users through our SDK. You agree that, in order to use our SDK, you will obtain appropriate consent from your users for the collection, use and sharing of Personal Information through our SDK , and that you will maintain and process all user data in accordance with your privacy policy and all applicable laws in any country in which your Mobile Properties are distributed or used and users are located.

#3

As a side note here is what my current privacy/consent page looks like (very ugly). I don’t ask but they can always go to the page and give me permission to use Admob. I don’t believe it is 100% compliant for GDPR but at least it shows that I am trying.

And here is the quote from Startapp that will be part of their GDPR policy:

When consent is not passed to StratApp (or provided to you) StartApp will continue serve non-personalized advertising. Nonetheless, StratApp may decide to separately seek consent directly from the user for StartApp’s use of personal data.

#4

So I guess I need to implement some kind of pop up in my game that asks for consent and shows the first time the game is run?

#5

If you show the pop-up consent and they say no what are you planning on doing? Close the app? 

This is just my opinion. My opinion only. If I was going to use Appodeal, I would not show any ads the x times they play a game. When they start their second or third game, I would give them an option either to buy the ad-free module or to consent to their personal data being used for targeted ads. If I had a reliable way to determine they were in the EU, I would do this scheme for users that are playing my game in the EU.

Another idea is to tie the consent to some currency in the game or to some other reward.

#6

Since they are only enforcing this in the EU, if I don’t get a chance to implement the new component before May 25, should I make my game temporarily unavailable in those countries until I get this sorted out?

#7

I guess that is an option. I don’t really know. Maybe others will chime in.

#8

We’re also trying to figure this out - from how i understand it now we have to do something like this. But as you can see from my questions after i’m pretty confused…

  1. Show a consent dialog ui at startup of the app, before Appodeal sdk is inited. Ask for consent to share user data with partners for monetization and analytics use. Link to terms / privacy policy where appodeal + all ad sdks are listed. 

  2. Store the record of the consent in a backend. how? what to store? 

  3. Provide a way for users to opt out and get tracked data removed. How to implement this? Is it needed if the consent is required to get into the app in the first place?

We’re also thinking about, as a tempory solution, doing a detection on the ip and if it’s an eu users we just won’t init appodeal at all. It will hurt us a bit revenue wise, but then we can wait and see how others will be doing.

#9

Just for me:

  1. I am not showing it at start-up. They can go and switch the consent to “on” by clicking on the icon.

  2. I am not storing the consent in any backend. I am storing it on the local device.

  3. I have a feedback form where they can ask to be removed from tracked data. In that case, I’ll just forward the request to the provider. Whoever that might be: Google or Doorbell (doorbell has a special email to do it).

#10

@agramonte Interesting - thanks for sharing! I have some questions about your plan - hope you don’t mind!

 Just trying to figure out what we could do in order to have a chance with this. 

  1. What would be the motivation for the user to turn it on? If it’s not necessary for playing the game? 

  2. From what i understand we need to keep a record of the GDPR consents (with identifier, timestamp and the terms on the consent date) to be able to prove we actually got the consent. But would be great if there was an opening to store the consent locally. 

3.  Feedback form is a great idea for data removal - i guess we could just use that as well and link to it from settings in the app. Wonder if we have to get the identifier of the user somehow then? In order to then pass it on to all the ad networks for data removal etc.

Pretty crazy all this - wonder if most appodeal games will actually have anything like this in place. Probably not. 

#11

It looks likes Google will allow turning off personalized ads, so I might just do that so I don’t have to mess around with this consent form.

#12

Yea that might work if you’re only using Admob and directly, not through Appodeal or other mediators

#13

It would be great if Appodeal allowed the same functionality to turn off personalized ads…

#14

It is just for me:

  • I am showing the consent pop at start up for every user since I don’t want to use any private server to get the user ip address. 

  • I will allow everyone to play without any ads for the first 3 times, then show the pop up. This would allow the players to make better decision whether they want to play more or not.

  • The pop up would state the following message: 
     
    To provide this app for Free To Play, this app uses Appodeal SDK for In App Advertisements. They may collect Personal data such as your device’s advertising ID, GPS data, IP addresses in order to show relevant ads. Do you consent? Note that the app will not function if you decline unless you buy No Ads feature.You can revoke consent from the settings screen at any time. Please press More if you are unsure.

  • If the user accepts then I would use the appodeal.init. and change the consent state to true and use os.date("%d-%m-%Y") to save the date. Then save the data locally and also in the players google snapshot file. 

  • If the user do not consent or is unsure then I take the user to the more info screen where this message along with my privacy, terms of use, no ads buy button, or consent button is shown

This app offers Ad-Free Experience also. You can buy this feature to turn off ads and prevent any data collection from Appodeal for showing you relevant ads.If you don’t want to buy then please give consent by pressing the Appodeal button and experience the game for free.You can use opt-out feature from your device settings to remove relevant ads, then Appodeal SDK may only collect non-Personal Information to show non-interest based advertising.

I have also added a consent button in settings in my app where the user can revoke consent when they wish and the app takes to more info screen either to buy no ads or consent option is shown.

This is the internal data structure: 
 
gameData.consentDataNoAdsFeatureBuy = false

gameData.consentDataAppodeal = false

gameData.consentDataAppodealDate = os.date("%d-%m-%Y")

gameData.consentDataRevokeAppodealDate = os.date("%d-%m-%Y")

gameData.consentDataGoogleAnalytics = false

gameData.consentDataGoogleAnalyticsDate = os.date("%d-%m-%Y")

gameData.consentDataRevokeGoogleAnalyticsDate = os.date("%d-%m-%Y")

This is so far I could think of now after the appodeal privacy update.  I was hoping they would take consent from user from the first ad screen being displayed. 

For me a backend server would create added complexity that i am not prepared to do now.

#15

Does anyone know of a way to detect region?  Until we get a better solution what would be nice is if I could detect if they’re in the EU and just not start Appodeal.

#16

You can pay for an IP geolocation service.  Something like https://www.digitalelement.com/geolocation/

#17

Don’t know if theres any good free ones? https://ipstack.com/ is free for 10.000 requests / month. I’m thinking of hosting one on our own server and use that.

@Sheekore:

Thanks for sharing! I like your idea with giving the player the option to buy the no-ads IAP if they decline the consent or opt out. 

#18

Anyone used system.getPreference( “locale”, “country” ) before? How reliable is it? I’m thinking of checking that and if they are in a EU country I don’t load any ads.

#19

Appodeal has put a new article on GDPR: https://blog.appodeal.com/blog/2018/05/08/appodeal-gdpr-guide/
Any idea to display window with consent only in EU countries? Free way of course :slight_smile:
 

#20

Also thinking about doing this for checking if a user is EU, but no idea if it will be considered good enough?. But checking IP isn’t foolproof either.