How to delete firebase auth user for Google's new data deletion policy

[mysticeti]

Hi

This package supports account creation by Firebase Auth using Google Play game services. Flutter plugin for Firebase Auth for Google Play game services only supports Android platform https://firebase.google.com/docs/auth/flutter/federated-auth#games.

Here is the copied section from the data deletion policy page https://support.google.com/googleplay/android-developer/answer/13327111?hl=en#zippy=%2Cwhat-are-the-requirements-for-the-web-link-and-resource%2Ci-offer-a-fully-integrated-in-app-account-deletion-experience-why-do-i-still-need-to-provide-a-link-to-a-web-resource

What are the requirements for the web link and resource?
The weblink must be functional (for example, loads without error), relevant in scope (for example, the pathway to request account deletion should be prominently featured and easily discoverable on the page) and reference the app or developer name (that is, as it appears on your store listing in Google Play). The user must be able to request deletion of their account through the pathway. You can offer this in many ways, like an additional link that initiates account deletion or a form they can submit a request through. If the user needs to take additional steps before deleting their account (for example, canceling a subscription), this must be clearly outlined, and a support flow must be available for users to initiate.

Since play store requires a web link for account deletion also on top of in app flow, did anyone find any solution how to implement it with this plugin? I have thought of a form where user email address or games profile username can be collected but unfortunately firebase console does not show results with game profile username or associated email id ( which I presume google does not send to firebase). Since this plugin creates a Firebase Auth user automatically, which means we need to also delete user data through a web link, not sure how to handle this scenario.

Google play game services data can be deleted via this link https://play.google.com/games/profile which solves part of the problem but deleting the firebase user data through website is an issue.

Any help is appreciated as the deadline for this policy is in December 2023 for existing apps and for new apps it is current so cannot publish an app.

[jonafeucht]

Thanks for posting this, haven't really looked into this since it was announced.

With OAuth and email you could just setup a nodejs where the user could just login, but since that's not possible with PGS and Game Center I personally would just deeplink the user back to the app. Something like this: example.com/user/delete, this will then open the inapp delete screen or take the user to a landing page where they would need to download the app.

Or you could redirect them to a contact form. https://support.google.com/googleplay/android-developer/answer/13327111?hl=en#zippy=%2Cwhat-are-the-requirements-for-the-web-link-and-resource

form they can submit a request through

Which begs the question, how would the user then know their uid…

This will be a headache… I'll really need to go through this thoroughly over the weekend.

[mysticeti]

The issue with deeplinking is that they specifically mentioned that even if we have an in app flow for deletion there should still be a way through weblink in case the user cannot install the app but still user should have control over data. If you check the other drop down options, here is the excerpt

I offer a fully integrated in-app account deletion experience. Why do I still need to provide a link to a web resource?
Some users may have already uninstalled your app or not be able to access your in-app experience for a variety of other reasons. We want to ensure that all users can still exercise control over their data by being able to go to the web link based deletion resource that developers provide.

I was also thinking about a form where user would provide there username or email id but unfortunatly via firebase console user name is not searchable and scrolling through would be difficult. GPGS do not send email id to firebase auth through which user signed up or else it would have been searchable through via firebase console. I agree this issue requires some thought. Could not find any solutions yet.

Thank you for looking into this issue.

[mysticeti]

Hi

Any solution found regarding this issue?

[mysticeti]

Hi @jonafeucht
I think this could be a possible solution for the above issue although would require credential linking which firebase does allow according to https://firebase.google.com/docs/auth/flutter/account-linking. One way that can be implemented is that

1. From the mobile game user signs in with google play games or game center with their respective credentials
2. From the web, users can only sign in using other providers such as google or apple sign which should be suffice for both platforms
3. When your library is used for the website, using credential linking when users signs in they can be shown the delete account through which firebase data can be deleted.
4. The only supported method for your web plugin would be the sign in method with different provider.

Let me whether if it makes sense.