Source
r/KotakuInAction•
Splutch

Unity Engine Analytics

GAMING

So in wake of the data mining controversy a few weeks ago, I believe I've found another offender? I was gifted a game from a developer who did a giveaway in r/pcgaming last week (Imperatum). I finally got around to playing it last night. It's pretty badly programmed so I was looking for config files to do some tinkering. While searching I found some of its install files in /appdata/locallow/. In the Unity folder is another folder titled "Analytics".

With a great heaving sigh I started digging in to see what I could find. I'm really not good at this kind of research so would like some help from you guys.

  • Unity Analytics seems to tie into Google Analytics. It scans for some standard things such as hardware, but also some custom Dev defined things.
  • There is no opt-out for the end user
  • There seems to be no opt-out for the developer either unless they are using Unity Pro

EDIT: I would love to stick around to see the development of this thread. But I finally get to play D&D for the first time since the 90's. So I'll be back later.

Posted Jul 23, 2018, 5:30 PM UTC · edited

9141
acp_rdit•

as far as I know unity analytics are on by default for new projects but the developer can opt out on the project creation page (or turn it off before building)

and as far as I can tell there isn't any hardware polling, you can see the API here: https://docs.unity3d.com/Manual/UnityAnalyticsTerminology.html

edit: there isn't any hardware polling data available in the developer analytics interfaces but that information is sent to Unity servers

there doesn't appear to be any identifiable segmentation information returned beyond country geolocation data and retention data

that said any software product can use standard libraries to scan your hardware and files on Windows and report that information back to a server

and there are Unity asset store packages that let you tie into google analytics: https://assetstore.unity.com/packages/tools/integration/google-analytics-60173

take all info with grain of salt, im still very much a beginner at Unity and gamedev so I could be missing something obvious

edit: further research has shown the "disable hw statistics" checkbox is grayed out in the free version. My conclusion then is that there is no way to build a game with the Unity free version that does not attempt to send hardware and other system information back to the Unity servers

31
SplutchOP•

From what I read, Hardware Polling is the one thing you absolutely cannot opt-out of. Even in GDPR countries. Devs opting out must pay more for the Pro version that allows the toggle switch. These are things I gathered from forum posts, not strongly investigated facts.

https://forum.unity.com/threads/why-does-unity-analytics-not-provide-a-user-opt-out.524979/

https://twitter.com/compositeredfox/status/1001115317479895040?lang=en

https://answers.unity.com/questions/866325/unity-5-disable-analytics-pro-only.html

10
acp_rdit•

following further threads it appears to be possible to prevent all data collection but it requires that the dev turn off the settings in their project: https://forum.unity.com/threads/unity-analytics-data-privacy-plug-in-available-now-in-the-asset-store.532484/#post-3507755

most interesting is this post https://forum.unity.com/threads/unity-analytics-data-privacy-plug-in-available-now-in-the-asset-store.532484/#post-3506654

It looks like Unity itself collects information such as hardware and generates a unique ID with Application-Device-Player and thats how it tracks things like retention

So like google if a developer wants to go the easy way and use Unity analytics tools then he will be exposing his user's data to Unity corporate

But any dev who wanted to should be able to connect to a self hosted analytics solution

edit: it isn't possible to prevent hardware and other data from being collected for games built in the free version of Unity

8
paranoidandroid1984•

It's also compulsory if you're using the free version, which kinda sucks (but I guess they need to upsell somehow).

3
Gorgatron1968•

I would not be surprised if the "developer" did not even know that the analytics thing was present. Seems way to big picture for all of the people out there trying to make a quick buck.

12
H_Guderian•

"Harmless like redshell" I see in this thread.

I said it before and I'll say it again. If my data is so valuable I should be able to sell it. If you've gotta sneak around to get it, then you've lost my trust.

10
Theodosian•

Because of this thread and did some checking on a few games and I found traffic going to https://buffpanel.com/ located in the second game I checked Surviving Mars.

This appears to be exactly like RedShell. I'm trying to find the dll's right now.

EDIT: BuffPanelSDK.dll or BuffPanel.dll but it can be renamed to anything. I got a bad feeling this is RedShell 2.0

EDIT2: I've sent an email to BuffPanel asking for explanations and warned the Surviving Mars subreddit. I'm sure this is in other games so I'll start checking.

EDIT3: More Games:

Hellion

Space Engineers (Not Confirmed)

7
SplutchOP•

Great sleuthing. Thinking about posting to r/games for more attention.

4
Theodosian•

Might need to, the mods in the individual game subreddits are weirdly hostile to even discussing this.

4
[deleted]•

[removed]

1
AutoModeratorMODAutomated sealioness•

Your comment contained a link to a thread in another subreddit, and has been removed, in accordance with Rule 5.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1
Jimmacle•

Yeah, because you post on our subs spreading rumors without doing the slightest amount of research. You claimed that Space Engineers has spyware via a library that isn't even present in the code base and made grand claims such as "it can collect anything" to stir up drama.

You can't just claim that any game analytics software is spyware especially without doing any actual research, it's such an uninformed thing to say.

0
Theodosian•

You are lying. I did not claim anything like that. I said the dev and the company BuffPanel had a publicized partnership and suggested the community check for anything unethical.

5
tet5uo•

Doing a quick search of my system yielded this:

https://i.imgur.com/FOYSJXP.png

2
regollyek•

Seems like cancer, but anyone worth their salt, anyone that is remotely a "real dev" will use Unity Pro.

4
HarkinHails_M•

Unity forces analytics in free version. It can only be turned off on Pro version. That's why a lot of Unity games connect to net despite being SP games. If a game is using pro version and still connects to net (not being an MP game), then the developer is keeping analytics on.

As far as I know, it's harmless and only there to help developers learn more about their audience (kinda like Redshell).

4
acp_rdit•

See my other comments in this thread. A Unity dev answered in their forum about how to turn off the data collection entirely. It is on by default but developers can turn it off in their individual projects.

This appears to work in the free version but I haven't confirmed by monitoring the traffic.

edit: you can only turn off all data collection in the pro version

1
MySidesTheyAreGoneThe Ouroboros of Oppression•

Is Imperatum the name of the game?

3
SplutchOP•

Yes, Imperatum. Developed and Published by ProSocial Games. Mind you, I'm not pointing fingers at this particular dev but potentially to any Unity game.

6
MySidesTheyAreGoneThe Ouroboros of Oppression•

The data the developer can access is stripped of all personal information.

https://docs.unity3d.com/Manual/UnityAnalyticsRawDataExport.html

It remains to be seen what data Unity collects on its side, but poking at binary files won't get anyone anywhere. Maybe someone can sniff the outbound packets? Good luck!

8
SplutchOP•

I downloaded GlassWire after I found it. But I assume analytics file already did its thing by the time I got it installed and I am not savvy enough to know how to investigate further. Hoping some smart people can do some examination and let us know what is up. I'm all for getting a thorough investigation before throwing stones. But I also am VERY opposed to how common and hidden this kind of spying really is.

3
malaiah_kaelynne•

The amount of data that is out there that you do not know about is staggering. Whether some unity game knows how you played the game or what hardware you run on is insignificant all in all.

2†
Narfhole•

After doing some grepping:

grep -oaPR "https?://[a-z0-9\-\.]+\.[a-z0-9]+/" .

in the TotallyAccurateBattlegrounds folder I found the following domains which may be involved in the data collection:

perf-events.cloud.unity3d.com
api.uca.cloud.unity3d.com
cdp.cloud.unity3d.com

Game seems to work with those in the hosts file.

3
NecessaryAardvark•

You can find what information is collected on their privacy policy. (would archive, but it isn't working now).

Unity: https://unity3d.com/legal/privacy-policy.

Unreal: https://www.epicgames.com/site/en-US/privacypolicy

Other engines have analytics/ telemetry too, but I'm not sure what they're like post GDPR.

Even Visual Studio (2015+) adds telemetry to programs. It tried to sneak it in as well, as they didn't tell anyone, and add it during compiling https://archive.fo/NbnzV. Originally, they said it was unfortunately named, and only stores data locally https://archive.fo/3zeqt. Then it started sending data to Microsoft, but it was okay because they'll add a feature to disable it. Then someone found out that telemetry was still active when the disable feature was selected, although ironically, mainly telemetry stating that telemetry was disabled https://archive.fo/BgDS6.

Of course Win10 also data mines what it can too, with the available disable options provided to user not really doing anything.

3
acp_rdit•

further research since I'm developing games with Unity:

The conclusion is that if you use the free version there is no way to build a game that prevents hardware polling and phonehome. According to the privacy policy the following information is collected:

Unique device identifier generated from the device MAC/IMEI/MEID, which we alter to limit the ability to identify the relevant device in the future;
An advertising ID, such as the Apple IDFA or the Android Ad ID;
IP address;
Device manufacturer and model;
The operating system and version running on your system or device;
Browser type;
Language;
The make of the CPU, and number of CPUs present;
The graphics card information, such as type, vendor and driver name, version and graphics API;
Amount of system and video RAM present;
Current screen resolution;
Unity Player and Unity Editor versions;
Operating system identifier (e.g., Mac, Windows, etc.);
A checksum of all the data that gets sent to verify that it did transmit correctly; and
App ID of the game installed
3
SplutchOP•

That's a pretty good generic list but doesn't acknowledge some of the extended features advertised.

Some notable ones-

  • Access data insights across all devices. Track player behaviors specific to your app. Analyze user behavior the way you want. Act upon the insights in real-time to customize user experiences.

  • With just a few clicks, you have instant access to critical metrics about user engagement, retention, and revenue from the Dashboard.

  • Track player behavior in your game

  • Gain a high-level overview of how your game is being used.

    Data Explorer

    Dive deeper into specific use cases with behavioral segments, annotate dates to track feature releases or historical events.

    Funnel Analyzer

    Understand player progress – and where they get stuck.

    Segment Builder

    Address different audiences by creating player groups based on unique game scenarios and behavioral patterns.

  • Unity Analytics 360° Video Heatmaps show you where your viewers look and how they react. A new component—the Heatmap Sender—samples which direction viewers are gazing and sends that data to the Unity Analytics service.

  • With Remote Settings, you can change your game for different segments in an instant. Remote Settings removes the need for developers to go through the lengthy process of modifying the game and then waiting for users to update the app. Use Remote Settings to:

    Roll out features gradually and monitor impact

Keep users engaged and increase revenue

Deliver native and high-performance graphics
1
acp_rdit•

most of that is the same stuff thats in the privacy policy translated from legal speak to marketing speak

the "track player behavior in your game" other than "loaded game on this day, this many times" is entirely built by the developer

so for example you want to see how many players started your tutorial but didnt finish your tutorial you would add an analytics event at the start of the tutorial, add an event at the end of the tutorial, then compare how often those events fired

this brackeys tutorial explains it better than I can:

2
HarkinHails_M•

These things are upto the developers. Tracking anything specific in-game. You'll have to manually add things to track (like a gameplay feature).

1
NEM3S1S•

"If it's free, you're the product."

Applies to Unity, too.

3
Narfhole•

I need domains to add to my hosts file, give.

Edit: Aw damn it, Totally Accurate Battlegrounds generated the folder.

2
mnemosyne-0001archive bot•

Archive links for this discussion:

I am Mnemosyne reborn. Brain the size of a planet and they ask me to remember silly websites. ^^^/r/botsrights

1
[deleted]•

[deleted]

1
[deleted]•

[deleted]

1
[deleted]•

[deleted]

1
[deleted]•

[deleted]

1
[deleted]•

[deleted]

1
[deleted]•

[deleted]

1
Lithovore•

There is no opt-out for the end user

PiHole.

Put that dusty old failed arcade project of yours to good use.

1
SplutchOP•

rusty old failed arcade project

Haha. We all have one of those don't we?

2