sentry-unity User consent

Have the SDK operate ‘properly’ but ‘hold off’ on sending events until consent is given. If revoked stop events from being sent again.

Depends on:

[x] https://github.com/getsentry/sentry-native/issues/110
[ ] https://github.com/getsentry/sentry-cocoa/issues/1780
[ ] https://github.com/getsentry/sentry-java/issues/1988
[ ] https://github.com/getsentry/sentry-dotnet/issues/1603

See also the meta issue at https://github.com/getsentry/team-mobile/issues/24

Oct 25 '22 10:10 vaind

This feature is really important to me! I'm using Sentry with Unity3D, Without this feature, I failed to meet the requirements for android app dist platforms! For workaround, I can only disable android native features, and do some magic in C# SentryRuntimeOptions to disable runtime init, but keep it in building then I cannot track android native bugs / performance issues. And it seems lead to crashes after disabling android native sentry, I'm still working on it.

Nov 03 '24 16:11 chenyanzz

Hey @chenyanzz, thanks for reaching out. This really helps us gauge interest for feature and prioritize development!

Nov 04 '24 19:11 bitsandfoxes

@chenyanzz a quick way around this today is to add a BeforeSend callback and just drop all the data there, if you don't want it to be sent automatically. If the user gave consent, you can flip the flag you check on BeforeSend, and let the data flow through

Nov 04 '24 22:11 bruno-garcia

Can BeforeSend prevent sdk from collecting device info? The privacy guideline forbids accessing MEID, DeviceID, etc. before user's consent.

Nov 05 '24 07:11 chenyanzz

Technically, this is very much feasible. Right now you'd need to implement this feature in multiple places as the SDK does not support setting native BeforeSend callbacks in C#. You'd need to:

Add your BeforeSend to the RuntimeConfig
With the native support for Android enabled have a second BeforeSend on the Android layer as well

Nov 05 '24 13:11 bitsandfoxes

But wait, do we even capture any of this data?

The privacy guideline forbids accessing MEID, DeviceID, etc. before user's consent.

What's MEID? I don't think we send device Id anywhere, we use our own "made up, installation ID" so that it's not used to track across apps

Nov 06 '24 01:11 bruno-garcia

But wait, do we even capture any of this data?

We do have things like DeviceUniqueIdentifier that we grab from Unity here https://github.com/getsentry/sentry-unity/blob/2bc00e7691a8dfde44905fe50f07c5a1822fa2ad/src/Sentry.Unity/SystemInfoAdapter.cs#L86

Nov 06 '24 08:11 bitsandfoxes

it reported as: "io.sentry.android.core" read sensors before user's consent. Seems that the problem is android sdk did gather info un-lazy. And android sdk is auto-inited by sentry-unity

Nov 06 '24 08:11 chenyanzz

which sensors require user consent? we can look at removing that out of the box. Or, as stefan suggested add the native beforeSend to drop data there.

Nov 06 '24 12:11 bruno-garcia

But wait, do we even capture any of this data?

We do have things like DeviceUniqueIdentifier that we grab from Unity here https://github.com/getsentry/sentry-unity/blob/2bc00e7691a8dfde44905fe50f07c5a1822fa2ad/src/Sentry.Unity/SystemInfoAdapter.cs#L86

we should consider not adding this by default

Nov 06 '24 12:11 bruno-garcia

we should consider not adding this by default

At the very least put it behind the PII flag?

Nov 26 '24 11:11 bitsandfoxes

To close the tangent on DeviceUniqueIdentifier: We're guarding it with the PII flag https://github.com/getsentry/sentry-unity/blob/f90b3ee1980435aa556ae63c8270a823277e1806/src/Sentry.Unity/Integrations/UnityScopeIntegration.cs#L89-L91

Feb 26 '25 13:02 bitsandfoxes