ironSource (LevelPlay) sends user data to Unity / ironSource. The SDK transfers the device advertising identifier and ad-interaction data to the ironSource ad network for ad delivery and mediation — a third-party transfer that App Store review, Google Play and the GDPR all require you to disclose. Generate a full privacy policy with this clause built in →
Does ironSource need a privacy policy disclosure?
Yes. ironSource, now part of Unity, provides the LevelPlay mediation SDK and the ironSource ad network. When an ad is requested or shown, the ironSource SDK collects your device advertising identifier (IDFA on iOS when App Tracking Transparency consent is granted, Google Advertising ID on Android), a self-created identifier unique to the app, identifiers shared only across apps from the same developer, device attributes (model, manufacturer, OS, app version), and data about the ads you see and interact with. ironSource's privacy policy also lists the device IP address.
ironSource acts as an independent data controller. Because it links in-app activity to advertising across apps and companies, it is "tracking" under Apple's App Tracking Transparency framework and Guideline 5.1.2, so it requires an ATT prompt before it can read the IDFA. If you use LevelPlay to mediate other networks (AdMob, Meta Audience Network, AppLovin, Vungle and others), each of those is a separate disclosure. The standalone Unity Ads SDK is also separate from the ironSource SDK even though both are Unity products.
What data does ironSource collect?
| Data type | Purpose | Linked to the user? | Used for tracking? |
|---|---|---|---|
| Device ID (IDFA with ATT consent, Google Advertising ID) | Third-party advertising, ad delivery, frequency capping | Yes | Yes |
| Self-created per-app ID and same-developer cross-app IDs | Ad delivery and capping without the advertising ID | Yes | Yes |
| IP address (per ironSource's privacy policy) | Ad delivery, geo targeting, fraud prevention | Yes | Possibly |
| Product interaction (ad requests, views, clicks) | Third-party advertising, analytics | Not applicable | No |
| Advertising data (ads seen) | Ad delivery and measurement | Not applicable | No |
| Performance data | Third-party advertising, SDK performance | Not applicable | No |
| Device attributes (model, manufacturer, OS, app version) | Ad rendering and compatibility | Yes | No |
ironSource's own Apple questionnaire table flags only the Device ID as used for tracking, but its privacy policy lists the IP address as collected while the questionnaire table omits any location item — when unsure, take the more conservative answer and declare coarse location. The exact list also depends on the mediated networks you enable.
Copy-paste privacy policy clause for ironSource
We use ironSource (LevelPlay), an advertising and mediation service
provided by ironSource Mobile Ltd., a Unity company, to display and
mediate ads in this app. When an ad is requested or shown, the ironSource
SDK collects and transmits to ironSource your device advertising
identifier (IDFA on iOS, Google Advertising ID on Android), app-specific
and same-developer identifiers, IP address, device attributes, and data
about the ads you see and interact with. ironSource acts as an
independent data controller and uses this data to select, deliver,
mediate and measure ads and to limit ad frequency. This processing
constitutes cross-app tracking. In the European Economic Area, the United
Kingdom and Switzerland we request your consent before ironSource loads
personalized ads, and for users in applicable US states we set a "do not
sell" signal. Learn more at
https://unity.com/legal/game-player-and-app-user-privacy-policy.Adapt it: name your company, list the networks you mediate through LevelPlay, and remove the same-developer identifier phrase if you publish only one app. This text is a starting point, not legal advice; you are responsible for its accuracy.
App Store "App Privacy" label answers
In App Store Connect, declare for the ironSource / LevelPlay SDK:
- Identifiers > Device ID — purpose Third-Party Advertising; Linked to the user; Used to Track You.
- Usage Data > Product Interaction and Advertising Data — Third-Party Advertising.
- Diagnostics > Performance Data — Third-Party Advertising and Analytics.
- Location > Coarse Location — declare if your integration sends the IP address for ad delivery.
Because ironSource accesses the IDFA, answer "Yes" to the tracking question and present an ATT prompt. The LevelPlay SDK is on Apple's list of commonly used third-party SDKs and ships a signed privacy manifest declaring required-reason APIs (UserDefaults, Disk Space; some mediated networks add System Boot Time and File Timestamp) from v7.9.0; keep it current for Guideline 5.1.2.
Google Play Data Safety answers
- Device or other IDs — Collected: Yes. Shared: Yes. Purpose: Advertising or marketing. Not processed ephemerally.
- App activity > App interactions — Collected: Yes. Shared: Yes. Purpose: Advertising or marketing, Analytics.
- App info and performance > Diagnostics — Collected: Yes. Shared: Yes.
- Location > Approximate location — declare if the IP address is sent for ad delivery.
Data sharing is "Yes": ironSource receives the data as an independent controller. Users can request deletion through Unity's privacy tools; describe that route in your policy.
ironSource-specific gotchas
- ironSource and Unity Ads are separate SDKs. Same company, different components and different data disclosures. Enabling the Unity Ads network inside LevelPlay bundles both — disclose each one you ship.
- The questionnaire table is narrower than the privacy policy. ironSource's Apple table lists no location item, but its privacy policy lists the IP address; pick the more conservative answer and declare coarse location if in doubt.
- Consent flags must be set before init. Call
setConsentfor GDPR andsetMetaData("do_not_sell","true")for US state laws before initializing the SDK; the first ad request is cached. - Same-developer identifiers. ironSource builds IDs that span your own app portfolio even without the advertising ID, which is relevant to your tracking disclosure.
- Child-directed apps. Set
setMetaData("is_child_directed","true")(or the device-ID opt-out flag); ironSource then drops the device identifier. - Mediation multiplies obligations. Each network mediated through LevelPlay needs its own disclosure and consent; Meta Audience Network additionally needs its Limited Data Use flag set.
Related
See the sibling clause guides for Unity Ads, Google AdMob, Meta Audience Network, and AppLovin MAX. For a Firebase and Google Analytics policy, see the Firebase privacy policy generator, and build the whole document with the privacy policy page generator.