0

I am having an Android App which uses certain service such as Analytics, Ad Networks.

I am taking the consent from the user at when the app starts, i.e. before collecting any info.

But there are some services that I need in order for the app to function properly without which my making app is of no use, such as Ad Networks.

If I mention in my privacy policy that "If you want to revoke your consent then your right to continue using the service ceases", will this be a valid option to revoke the consent? Or is there anything wrong if the users has to delete the app from his phone to revoke his consent?

Improve this question
1

1 Answer 1

Reset to default
2

First, as noted elsewhere, consent is not a mandatory requirement for processing of personal data under GDPR.

However if you are going to use consent as your legal basis for processing, then you need to make sure (as noted by @MSalters in a comment to your question) that: "Consent must be freely given and specific".

Specific means that consent must be granular, so you need a separate consent for each purpose for which you collect personal data. I.e. you need one consent for "Analytics" and another one for "Ad Networks". Then for each purpose you collect data, you must state, what personal data you collect for what specific purpose you collect this particular data. I shall assume that your consent form is already designed to be specific, or that you can alter it to meet this requirement.

The second requirement is freely given, and it is a much more problematic requirement from your point of view. What this really means is described in Recital 43. It says that consent is not freely given:

if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

This means that that you do not have the right to say: "if you revoke consent, your right to continue to use this service ceases", unless it is practically impossible for you to provide the service without the user's consent.

I can imagine some service where this may be the case. For instance, if your service is to provide personalized book recommendations based upon what books the user has previously indicated he or she "liked" – you cannot do this unless the user consent to you keeping track of "likes".

However, for the majority of "free" services that are provided in exchange for personal data, this will not be the case. In these cases the user may refuse or withdraw consent, and still have the right to access and use the same service. That is: He or she cannot be refused service, or be required to delete the app, when the user refuses or withdraws consent.

I think there is broad consensus that this aspect of the GDPR is going to massively disrupt many successful pre-GDPR business models based upon personal data being commodified and used to pay for some free service.

While it may be "necessary" for a business to make money in order to stay in business, this is not "necessary" according to the GDPR. In "Opinion 4/2017 - on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content", the European Data Protection Supervisor writes:

There might well be a market for personal data, just like there is, tragically, a market for live human organs, but that does not mean that we can or should give that market the blessing of legislation. One cannot monetise and subject a fundamental right to a simple commercial transaction, even if it is the individual concerned by the data who is a party to the transaction.

Of course, I don't know the specifics of your app, so I have no way of knowing whether whether the personal data you collect really are "necessary" for the app to work. If they are necessary, it is OK to not provide the service to users who do not consent to the ToS. But if they are only necessary for you to make a profit, or some other commercial purpose, you may need to rethink your business model.

Improve this answer
2
  • Thanks for the long and detailed answer. But in my case I am using the AdMob SDK to provide the ads. They collect personal data for two reasons 1) To provide personalized ads, 2) To prevent malicious activities with the ads. The users can turn off the personalized ads setting from the phones settings. But still AdMob will continue to collect some personal information to tack any malicious clicks or users and to defend frauds. That is my necessity as If I remove the AdMob SDK then I wont be able to run my show without any revenue. Is this case valid under GDPR?
    – Rajesh K
    Commented May 20, 2018 at 10:54
  • 1
    Prevention of malicious activity sounds like a legitimate interests pursued by the controller or by a third party GDPR Article 6 (1) f. Note that this is an alternative legal base (i.e. consent will not be required if this option is used).
    – Free Radical
    Commented May 20, 2018 at 10:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .