Unity Ads sends user data to Unity Technologies. The SDK transfers device identifiers, IP address, purchase and gameplay-interaction data to Unity for ad delivery and measurement — a third-party transfer that App Store review, Google Play and the GDPR all require you to disclose. Generate a full privacy policy with this clause built in →
Does Unity Ads need a privacy policy disclosure?
Yes. Unity Ads is Unity's mobile advertising network. When an ad is requested or shown, the Unity Ads SDK sends Unity your device advertising identifier (IDFA on iOS when App Tracking Transparency consent is granted, Android Advertising ID on Android), the vendor identifier (IDFV) or Android device ID, your IP address and the country mapped from it, device attributes (make, model, OS, language, screen size, connection type), data about the ads you see and interact with, and purchase history you pass to the SDK.
Unity acts as an independent data controller for advertising data and requires its ad partners to honor opt-out and deletion requests. Because Unity Ads links in-app activity to advertising across other apps and companies, it is "tracking" under Apple's App Tracking Transparency framework and Guideline 5.1.2, so it requires an ATT prompt before it can read the IDFA. Unity merged with ironSource in 2022; the standalone Unity Ads SDK and the ironSource/LevelPlay SDK are still separate components with separate data disclosures.
What data does Unity Ads collect?
| Data type | Purpose | Linked to the user? | Used for tracking? |
|---|---|---|---|
| Device ID (IDFA with ATT consent, IDFV, Android device ID) | Ad delivery, measurement, frequency capping | Yes | Yes |
| User ID (if you set one) | App functionality | Yes | No |
| IP address and coarse (country-level) location | Ad delivery, geo targeting, regulatory compliance | Not applicable | No |
| Purchase history you pass to the SDK | Third-party advertising, analytics | Yes | Yes |
| Product interaction (app launches, taps, video views, saved progress) | Third-party advertising, analytics | Not applicable | No |
| Advertising data (ads seen) and other usage data | Ad delivery and measurement | Yes | No |
| Performance data (launch time, hang rate, energy) | App functionality, analytics | Yes | No |
| Device attributes (make, model, screen size, language, connection type) | Ad rendering and delivery | Yes | No |
Only the Device ID is flagged by Unity as used for tracking, and only after ATT authorization. The exact list depends on your configuration: passing purchase events or a user ID, and enabling analytics alongside ads, all expand what you must disclose.
Copy-paste privacy policy clause for Unity Ads
We use Unity Ads, an advertising service provided by Unity Technologies,
to display ads in this app. When an ad is requested or shown, the Unity
Ads SDK collects and transmits to Unity your device identifiers
(including the advertising identifier where you have granted permission),
IP address and country, device attributes such as model and operating
system, information about the ads you see and interact with, and any
purchase events we choose to send. Unity acts as an independent data
controller and uses this data to select, deliver and measure ads and to
limit ad frequency. This processing constitutes cross-app tracking. In
the European Economic Area, the United Kingdom and Switzerland we request
your consent before Unity Ads loads personalized ads, and for users in
applicable US states we set a "do not sell" signal. Unity deletes a
user's data on request. Learn more at
https://unity.com/legal/game-player-and-app-user-privacy-policy.Adapt it: name your company, drop the purchase-events phrase if you do not send them, and note China's separate PIPL consent path if you ship there. This text is a starting point, not legal advice; you are responsible for its accuracy.
App Store "App Privacy" label answers
In App Store Connect, declare for the Unity Ads SDK:
- Identifiers > Device ID — purpose Third-Party Advertising and Analytics; Linked to the user; Used to Track You.
- Identifiers > User ID — only if you set one; purpose App Functionality; Linked.
- Purchases > Purchase History — if you pass purchase events; Third-Party Advertising and Analytics; Linked.
- Usage Data > Product Interaction and Advertising Data — Third-Party Advertising and Analytics.
- Diagnostics > Performance Data — App Functionality and Analytics; Linked.
- Location > Coarse Location — country-level, derived from IP; Third-Party Advertising and Analytics.
Because Unity Ads accesses the IDFA, answer "Yes" to the tracking question and present an ATT prompt. The Unity Ads SDK is on Apple's list of commonly used third-party SDKs and ships a signed privacy manifest declaring required-reason APIs (such as UserDefaults); keep it current for Guideline 5.1.2.
Google Play Data Safety answers
- Device or other IDs — Collected: Yes. Shared: Yes. Purpose: Advertising or marketing, Analytics. Not processed ephemerally.
- Location > Approximate location — Collected: Yes. Shared: Yes. Purpose: Advertising or marketing, Analytics.
- Financial info > Purchase history — if you pass purchase events. Collected: Yes. Shared: Yes.
- App activity > App interactions — Collected: Yes. Shared: Yes. Purpose: Advertising or marketing, Analytics.
- App info and performance > Diagnostics — Collected: Yes. Shared: Yes.
Data sharing is "Yes": Unity receives the data as an independent controller. Users can request deletion; Unity propagates the request to ad partners, which must delete data received from Unity Ads. Describe that route in your policy.
Unity Ads-specific gotchas
- Unity and ironSource ship separate SDKs. They are one company, but each SDK has its own data disclosure. If you run LevelPlay mediation with the Unity Ads adapter you are bundling both and must disclose both — see the ironSource clause guide.
- Unity Ads collects purchase history. Unlike most ad SDKs, it can ingest purchase events, so you may need to declare Purchases and Financial info that other ad networks do not require.
- China needs PIPL consent. Unity exposes a separate
Consent.piplpath in addition to GDPR and CCPA; set it before initialization for users in China. - Consent must be set before init. Wire the GDPR and CCPA privacy APIs before the first ad request or the initial call goes out without your signal.
- IDFV is always collected. ATT gates only the IDFA; the IDFV, Android device ID and IP address are still sent when tracking is denied, so keep the disclosure.
- Child-directed apps. Set Unity's COPPA / age flag; Unity Ads is not permitted to serve personalized ads to known children.
Related
See the sibling clause guides for ironSource (LevelPlay), Google AdMob, Meta Audience Network, and AppLovin MAX. For a Firebase and Google Analytics policy, see the Firebase privacy policy generator, and build the whole document with the privacy policy page generator.