[Bug]: call event firebaseinstallations.googleapis.com after installing onesignal if firebase_analytics_collection_enabled = false

[workmanTwo]

What happened?

I have a Unity project that contains Firebase Analytics. The manifest contains the line "firebase_analytics_collection_enabled = false" to prevent the request from being sent to "firebaseinstallations.googleapis.com". Works as it should. But after adding the OneSignal package (even without any initialization from the scripting side), the "firebaseinstallations.googleapis.com" request starts being sent, even though the manifest contains restrictions.

Steps to reproduce?

1. create new unity project, set Android as current platform
2. Integrate Firebase Analytics, and make sure there is absolutely no usage of Firebase in the code
3. Make a build
4. Using any debugging proxy (such as Charles), make sure that firebaseinstallations.googleapis.com request is called when the application starts.
5. Add into manifest string "<meta-data android:name="firebase_analytics_collection_enabled" android:value="false" />"
6. Make a build
7. Using any debugging proxy (such as Charles), make sure that firebaseinstallations.googleapis.com request is absent
8. Integrate OneSignal, and make sure there is absolutely no usage of OneSignal in the code
9. Make a build
10. Via any debugging proxy application (for ex. Charles) check that firebaseinstallations.googleapis.com request present.

What did you expect to happen?

Expected behavior: The firebaseinstallations.googleapis.com request does not occur after installing OneSignal if the "firebase_analytics_collection_enabled" flag is set to "false".

This bug affects user privacy. Because the data is sent regardless of the configured permission.

Unity version

2022.3.14

OneSignal Unity SDK version

5.0.5 (latest)

Platform

Android

Relevant log output

No response

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

[jkasten2]

Thanks for reporting, is this still an issue if you set OneSignal.ConsentRequired = true; as noted here? https://documentation.onesignal.com/docs/mobile-sdk#require-privacy-consent