Unity, CCPA and Data Privacy
As of January 1, 2020, the California Consumer Privacy Act (CCPA) will bring new legal and data privacy rights to consumers in the state of California. The CCPA provides specific protections for individuals in California pertaining to how their personal information is collected, what personal information is collected and options for exercising certain data privacy rights.
What is CCPA?
CCPA stands for the California Consumer Protection Act. CCPA will empower users to know the types of personal information businesses collect on them, request access to personal information collected, request deletion of data and/or request no sale of personal information to other parties.
Similar to GDPR, the CCPA applies to “personal information” that is broadly defined to include IP addresses, browsing histories, and inferences drawn from any of the identified information that creates a profile that reflects the consumer in the following ways: preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
What is the difference between CCPA and GDPR?
What do I need to do with respect to using Unity’s services?
If you are a game player of a MWU game or a general consumer, understand that you may be presented with options along your journey to exercise your privacy rights as it pertains to information Unity collects. Look out for these indicators and the Unity privacy icon () to learn more.
For more information, read on.
I'm a game player
What are my rights under CCPA?
As a game player, you have the right to opt out of the sale of your personal information, request the deletion of certain personal information, and/or request a disclosure of personal information from Unity. In general, Unity does not have enough information about you as an individual to verify your identity through a mailed or emailed request. We can only authenticate who you are when you are inside an app (i.e. a game).
How do I exercise my rights?
To exercise your rights under CCPA, you can start by clicking on the privacy icon in the left bottom corner of a Unity ad. The icon looks like this:
Once you click on this icon, you will be guided through a series of steps to achieve the changes or requests you prefer.
You can opt-out of personalized ads inside of the game you are playing, or, if you provide your preferred email inside the ad, you can get a link to order a personal information disclosure report. This means you will receive a report for all the data we collect in games you play that use Unity ads. You will also be able to opt-out of personalized ads for the game you are playing at that time. We will not use your email for any purpose other than helping you exercise your privacy rights.
Please note if the publisher of the game you are playing does not offer you the opportunity to opt-out before a Unity ad is sent, Unity will provide you with an opportunity to opt-out before we use your information to personalize your ads. This does not mean that you will not see and ad at all, but any ad you see will not be based on data we may have about you until after the opt-out opportunity.
What about "selling" information? Does Unity Ads Network actually sell personal information?
To begin, Unity does not, and will not, provide your personal information in direct exchange for money. Therefore, in the literal sense, Unity does not sell your personal information. However, the CCPA requires Unity to disclose if it sells personal information and under its expansive definition of “sell”, Unity believes the following activities may constitute a CCPA sale of personal information. When you play a game that utilizes Unity’s Ad Network, the device you are using sends an advertising identifier (called an “Ad ID”) to Unity. Under the CCPA, this Ad ID is considered personal data. Why? Because it may include information on you such as your location, the device you are using, some of the activities you’ve completed in your game and more. We have included more detail and a link to what’s defined as “personal information” below for your convenience. Unity shares the Ad ID with our advertising and publishing partners and sometimes these partners may use this Ad ID to look up information about you. This may include things like your online activities, purchases you’ve made or websites you’ve visited. This is all done to personalize future advertisements you may see. In fact, the whole point is to give the advertiser an opportunity to advertise to you - and specifically to you - with a personalized ad. For this reason, under CCPA, sharing the Ad ID may be a sale of personal information.
What type of game player data does Unity collect?
Depending on the type of interaction you have with Unity, Unity may collect data in a variety of categories. These categories include: user identifying data (name, username, photos), contact information, location and payment data, the device you’re using and more. You can see more information on Unity’s data collection and use practices on Unity’s Do Not Sell My Personal Information page.
What if I am playing a game that was made with Unity? What happens then? Is Unity collecting information on me?
If you are playing a game that uses Unity Ads, has Unity Analytics enabled or uses other Unity services that personalize, then, yes, Unity is collecting personal information on you. While this is controlled on the publisher side, you do have the ability to opt out of data collection. Please note that Unity does not believe the usage of analytics by your developer is a "sale" of personal information; however, we have offered the opt-out opportunity to this service. To access your privacy settings, look for your privacy information and account services (each location will be different in each game) and if you have trouble finding it, contact the games provider. Once you begin to exercise your privacy rights, you will, however, be pushed into the new Unity web flow that will guide you through the process.
If you do not see these options, your developer has enabled privacy controls to create a more privacy-protective experience or to indicate that this app is directed to children under the age of 13. As a result, we deliver ads to you based only on contextual data (e.g., the game you are playing).
What happens when I request data deletion and to opt out?
We will delete the personal information that we have on you for the game within 30 days and opt you out of personalization for the app immediately. We will also stop collecting any PII on you in the future. For information on what types of information we collect on you, please see above.
For profile purposes personal information deletion will take 30 days to complete. Please note, we may retain your data for invoicing and fraud prevention purposes for 180 days.
If I do decide to opt-out or delete my personal information what does that do to my game experience? Does it affect my game account? Will I lose my status or token bank?
If you decide to opt out and delete your personal information, you may not receive in-game personalized content. Also, the ads that you see in your game may be less relevant to you as there will be no personalization. However, your game account, economy and status will not be affected. I requested a data report and have not received notification that it is ready? Please allow Unity up to 30 days for compile any personal information reports. If you still have not received your report after that time please contact DPO@unity3d.com.
I'm a Unity developer
Where is Unity addressing CCPA?
Unity Ads Data
Unity is making changes to its SDK in the background to update its systems for compliance with CCPA. This means that no native changes are required. First, for data disclosures, players of made with Unity games will be able to click the privacy icon () we have placed in our ads unitts in order to 1.) Continue to obtain a data disclosure inside the app per CCPA requirements (Note this also stands for GDPR requirements); 2.) Provide an email in order to get a link to a downloadable PDF of all their data within Unity’s ad network or request a printed copy by mail, where available; and 3.) Exercise opt-out and deletion requests, where applicable.
With respect to opt-out requests, Unity is not the direct collector of the data under California law, but we are offering the following options to communicate any opt-out on the developer side: 1.) Similar to GDPR, a developer with their own compliance tools can communicate their own opt-out through the API if they choose to collect the data; the technical documentation for this can be found here 2.) The first time a user sees the ad, Unity will serve a contextual-only (non-personalized) ad if there is no compliance signal from the game, as well as an opt-out opportunity and 3.) Unity will endeavor to implement other industry-standard opt-outs in Q1 of 2020, such as DAA.
Unity Analytics & Editor Runtime Data
Unity is updating its GDPR plug-in in the webview to accommodate necessary changes for CCPA, including permitting the player to get an emailed PDF or printed copy of their personal information by mail. This means no native changes are required. For clarity, Unity does not believe its analytics product requires an opt-out under CCPA, as it is not a sale of personal information under CCPA. However, we're doing this because we want to ensure that all personal information collected by Unity products - including our analytics tools - adheres to the same protection policies.
What are my rights under CCPA?
As a Unity developer, you have a right to request the deletion of certain personal information, and/or request a disclosure of personal information from Unity. You may do this in the privacy settings of your account. Please note, Unity cannot delete personal information it uses for business purposes, including billing and payment records, license verification, fraud prevention information, and data to assure security and integrity of our systems. For purposes of clarity, Unity does not believe that we share developer personal information in any way that constitutes a “sale” of personal information under California law; however, we permit you to “opt-out” of certain uses of your information, such as contributing information to certain usage statistics analysis.
How do I exercise my rights?
We have rolled out a more centralized privacy settings page to ensure you can exercise your rights from a central location. This new privacy settings page will enable Unity users to make changes to opt-ins and opt-outs, make personal information requests and more and can be accessed via the “Privacy” link on your “My Account Settings” page. Here you can also turn off the collection of certain usage statistics for the editor* in your privacy dashboard as well as download PDFs of your personal information disclosure. If you are a Unity developer, please log in to your account and view your privacy settings page to obtain data disclosures and adjust your privacy settings.
*Please note there are certain pieces of data that are always collected, such as information for valid license enforcement. In these instances, users cannot opt-out of the data collection.
What about players rights? What happens then? Is Unity collecting information on players of my game?
If you are a developer or publisher that uses Unity Ads, Unity Analytics or any other personalization service (e.g., GameTune), then yes, Unity might be collecting personal information on the player of your game. In the case of Unity Ads, the player will have the option to opt out of personal information collection and request a report on the personal information collected. For other personalization services, it is up to you, the developer, to implement the proper configurations that abide by CCPA laws and regulations.
Has anything changed for my game players that I need to be aware of?
Yes, when requesting privacy changes, a player will enter into a new web flow that will guide them through each step depending on what action they would like to take. This includes submitting an email to request a personal information disclosure instead of having it immediately returned to them. If there are any question about this flow, how it has changed or any issues please contact DPO@unity3d.com.
I deleted my Unity developer account. Do I have to set up a whole new account if I want back in?
Correct. If you were once a Unity user and deleted your account, you will need to begin the process over again. You will be able to use the same email to create a new account since all your information was deleted the first time. For more information on getting started again with Unity, please go here.
I requested a personal information disclosure report and have not received notification that it is ready?
Please allow Unity up to 30 days for compile any personal information disclosure reports. If you still have not received your report after that time please contact DPO@unity3d.com.