gdpr google coppa
Using Sentry in an app targeting children below 13 years
<p>We have created a children game using Unity and therein we use SentrySDK for automatic bug reporting.
Since our app is targeting children under 13 years, we need to comply with</p>
<ul>
<li>COPPA</li>
<li>GDPR</li>
<li>Google's Familiy Policy</li>
</ul>
<p>We use sentry like this. If an error occurs in the app, the app sends a message with the stacktrace and an anonymous user id to the Sentry Cloud.</p>
<p>Is this legal or do I need user consent for this?
And if so, does it have to be &quot;opt-in&quot; or &quot;opt-out&quot;?</p>

<h2>Are you collecting personal information?</h2>
<p>A user id, assuming that it is the same per user across time, is personally identifiable information for both COPPA and GDPR, and would need to meet Google’s requirements as well.</p>
<p>This is true even if there is no obvious way of linking this back to an identifiable person. If the id is instead a session id that is never used more than once, then it is not personal information.</p>

<blockquote>
<p>If an error occurs in the app, the app sends a message with the stacktrace and an anonymous user id to the Sentry Cloud.</p>
</blockquote>
<p>There is no such thing as an &quot;an anonymous user id&quot;. It either identifies a user, then it is personal data, or it doesn't, then it's just random byte garbage. Since your app is contacting this cloud service <em>directly</em>, not via your servers as a proxy, you also exposing the customers IP address to a third party.</p>
<blockquote>
<p>Is this legal or do I need user consent for this?</p>
</blockquote>
<p><strong>An IP address is PII, exposing it to a third part needs consent.</strong> Given that your app would be perfectly usable if this feature did not exist, you cannot claim it is absolutely neccessary for the operation (like sending the IP address to your <em>own</em> servers, which is simply how the internet works). If you would send all that to your own servers, strip the user id and ip address and send just the stacktrace devoid of any personal information to a third party, I would say you are safe. But the user id and ip address are PII that you need consent for, before sending them to a third party.</p>
<p>Normally, this is done in the fine print of the terms of use one has to accept before being able to sign up for an account in the app.</p>
<p>If you don't have an app with accounts, you could simply let the user <em>chose</em> to do this (or not) at the first app start. That is more user friendly and it established explicit consent to either do it, or not.</p>

<p>By default, our SDKs are configured not to send any PII data, see: <a href="https://docs.sentry.io/platforms/unity/configuration/options/#send-default-pii" rel="nofollow noreferrer">https://docs.sentry.io/platforms/unity/configuration/options/#send-default-pii</a></p>
<p>So if you, the developer, don't explicitly turn it on or add other data to the events sent to Sentry, you should be safe.</p>
