CardinalComm SDK Warning from Google Play

Integration Details:

• SDK/Library version: 4.12.0
• Environment: Production
• Android Version and Device: All
• Braintree dependencies: gradle (app level)

implementation ‘com.braintreepayments.api:card:4.12.0’ implementation ‘com.braintreepayments.api:data-collector:4.12.0’ implementation ‘com.braintreepayments.api:three-d-secure:4.12.0’

app (project level)

maven { url "https://cardinalcommerceprod.jfrog.io/artifactory/android" credentials { username **** password **** } }

Describe the bug I am using the above mentioned brain tree sdks (v4.12.0) and today I received a warning from Google Play with the following message: Your app is using the Cardinal Mobile SDK which collects persistent device identifiers, but may not be limited to Android ID and hardware IDs. Persistent device identifiers may not be linked to any other personal and sensitive user data and/or resettable device identifiers (e.g., IMEI, IMSI, SIM Serial #, etc).

You may consider upgrading to a policy-compliant version of this SDK, if available from your SDK provider or removing the SDK. According to your SDK provider, you may consider upgrading to 2.2.7-2. Please consult the SDK provider for further information. Google is unable to endorse or recommend any third party software.

Thank you in advance

[hollabaq86]

Hi folks, can I get 👍 reactions from folks getting these notifications that:

1. You are on the latest version of the SDK (4.20.0)
2. The text of the notification from the Google Playstore specifically mentions the following:

Your app is using the Cardinal Mobile SDK which collects persistent device identifiers, but may not be limited to Android ID and hardware IDs. Persistent device identifiers may not be linked to any other personal and sensitive user data and/or resettable device identifiers (eg, IMEI, IMSI, SIM Serial #, etc).

If the contents of the notification you’re getting from Google is different, please drop that in a comment here or contact Support referencing this issue.

We need a solid confirmation of this info so that we’re correctly escalating the issue and that version 2.2.7-2 of Cardinal’s SDK indeed does not resolve these alerts. Thanks all for your patience as we try to resolve this 🙏

I also want to mention that we are actively trying to reproduce these notifications with a demo app, too, but in the interest of the urgency of this issue we’re asking for your help in confirming a few things. Thanks!

[bm185178]

What’s the concrete step for this? Would it be resolving the warning if we upgrade braintree sdk 4.18.0 which supports 2.2.7-2? This warning will suspend our customers’ releases in the future if we do not do comply. This should not be taken lightly because dealing with google suspension is not easy and this is a legal matter. We need an answer asap.