IP and location are transmitted even though CoppaControl is activated

[nblum37]

IP and location are transmitted even though CoppaControl is activated

[Mercy811]

Hi @nblum37, have you ever sent IP and location before enabling COPPA? If so, Amplitude's backend uses history IP and location data. Could you log the payload of events sent to see if IP and location are include? If not, it means COPPA is set successfully. You can simply test with another user id or create another project and send events to the new project.

[nblum37]

No, so COPPA was enabled starting from the very first attempt to include Amplitude. I see the same behavior if I change to a user that was not logged before, meaning also the location and IP are tracked.
As the Amplitude traffic is sent via a native package, it is not straightforward to intercept the packages before being HTTPS encrypted. Does the framework offer the possibility to enable verbose logging in the console? Or how can I log the payload?

EDIT: Is it possible that clearUserProperties() resets the COPPA setting? If I enable COPPA again after clearing the user properties, it seems to work fine. The only question would be then, if also other settings like server region and so on need to be set again, as well?

[Mercy811]

Hi @nblum37, could you share your project link so that I can check if Ip and location are in raw requests. clearUserProperties() internally send a $clearAll event to clear all history user properties including region in DB so it should work.

[nblum37]

Thanks for the reply. I sent the link to your GitHub e-mail address.

So it seems to keep COPPA enabled if I use the following code to set user properties

  Future setUserId({@required String? id}) async {
    id = id?.split('_').lastOrNull ?? id;

    await _analytics.enableCoppaControl();
    await _analytics.setUserId(id);
  }

[Mercy811]

Hi @nblum37, thanks for sending you project link. I've checked that for user 830acde4-ef26-4411-a9b1-150957cb3a83, IP address is not tracked in the event payload. Note that COPPA covers "geolocation information sufficient to identify street name and name of a city or town" which means if you enable it, Amplitude will not track Ip address, city, latitude, longitude. (code reference and doc). If you want to disable tracking country and city, please follow this doc.

Looks like the SDK works as expected as far as I investigate. Could you share a link of the event/user if there is a special case tracking COPPA info.

For your last comment, did you solve it by putting enableCoppaControl() inside?