Is my app or its dependencies violating the Android Advertising Id policy?
Disable advertising id collection
According to the Firebase docs you can disable advertising id collection by setting:
<meta-data android:name="google_analytics_adid_collection_enabled" android:value="false" />in your AndroidManifest.xml under the <Application> tag.
EDIT: It seems like people are having mixed success with this approach. Try adding configurations { all*.exclude group: 'com.google.firebase', module: 'firebase-core' all*.exclude group: 'com.google.firebase', module: 'firebase-iid' } to the Gradle app dependencies area as per comment below.
Today many developers are getting this same issue. I also got this issue. I didn't collect any sensitive data, I am not even showing ads to my users. In your case the Crashlytics lib could be an issue. It deals with advertising IDs.In the mail they mention the required action:
Action required: Add a privacy policy to your store listing and app
So I think all of us should add a privacy policy on the store listing as well as on the app. Before taking the action we should go through the related privacy policy.Here are some links from where you can get help:
Privacy policy to upload an app
Usage of Android Advertising ID
You are using crashlytics below 2.9.3. Apparently it's collecting and sending the google advertising id as a key in their header. That might be the or one of the issues. You can check if it's sending the advertising id through a proxy like Charles.
Edit ***It seems that version 2.9.3 and above are still getting the advertisingID from by calling AdvertisingIdClient.getAdvertisingIdInfo() from the com.google.android.gms.ads.identifier package. I checked it by setting a break point on the method. I am assuming it is somehow still being send to fabric. Which would mean updating to higher version will not solve it..