Firebase IID 21.1.0 / Cloud Messaging RPC 16.0.0 — Token Registration Encryption and Play Data Safety

[hanuel143-ui]

Hello Firebase Android SDK maintainers,

We are reviewing the SDK-related data handling and encryption properties of an Android application's release build to ensure accurate Google Play Data Safety disclosures.

Verified dependency versions:

• com.google.firebase:firebase-iid:21.1.0
• com.google.android.gms:play-services-cloud-messaging:16.0.0

These artifacts were identified in our release dependency inventory. Their presence alone does not prove that token-registration operations execute at runtime.

We would appreciate clarification of the following points specifically for these versions.

1. Encryption of token registration traffic

When Firebase Instance ID / FCM registration, token retrieval, or token refresh uses Google Play services:

• Is all network communication with Google's registration backends protected by HTTPS/TLS?
• Does that protection also apply to retries and fallback paths?
• Are there any supported execution paths that transmit registration-related identifiers or token data over an unencrypted network connection?
• Can you distinguish local Android IPC between the app and Google Play services from network communication between Google Play services and Google's servers?

2. Automatic initialization and registration

Does merely including either dependency, including transitively, cause automatic token registration or network data transmission without an explicit application-level FCM API call?

If this depends on Firebase initialization, auto-initialization settings, or another component, please clarify the conditions.

3. Data transmitted or collected

For registration-related operations using these versions, which data fields are transmitted to or collected by Google?

In particular, where applicable:

• Firebase Instance ID, Firebase Installation ID, or FCM registration token
• App identifier, package information, and application version
• Device model, OS version, and other device metadata
• IP address or other network-related identifiers
• Any additional identifiers, diagnostic information, or metadata

Please distinguish automatically collected data from data collected only when particular features or operations are enabled.

4. Google Play Data Safety implications

Which documented SDK-specific facts can developers rely on when evaluating the following Data Safety declarations?

• Data collected
• Data shared
• Data encrypted in transit

We understand that the application's overall Data Safety declaration remains the developer's responsibility. We are requesting clarification of the SDK's behavior, rather than an assessment of the entire application.

We have reviewed the Firebase Android data disclosure documentation and the Cloud Messaging transport security documentation. However, we could not establish whether their statements fully cover these exact legacy artifact versions and the Google Play services-mediated registration path.

References:

• https://firebase.google.com/docs/android/play-data-disclosure
• https://firebase.google.com/docs/cloud-messaging/encryption
• https://developers.google.com/android/reference/com/google/android/gms/cloudmessaging/Rpc

If there is an official version-specific reference or a more appropriate Google team that can confirm these details, a pointer would be greatly appreciated.

Thank you for your assistance.