Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
Is it legal if we do not offer an explicit opt-out option in our app for non-persnonal data collection?
We planned to explain to the user what data we collect and at the bottom of the screen there would be a button that would say something like "I understand". By pressing that button user would be able to open the rest of the app and use the app. The above mentioned screen would be the first screen new users would see. All users could opt out afterwards in the app settings.
Either consent is required or not, depending on your use of the data. If consent is not required, you are fine.
If consent is required, and you don’t allow users of your website access without consent, then pressing whatever button to be able to use your site doesn’t constitute consent, so you would be handling data from any EU residents without consent.
Before you start Processing Personal Data (collecting; storing; accessing; processing; sharing) you must have a defined Lawful Base to do it.
If it is an App and people will download it themselves, then you must start by making clear the Terms of Service... so if Personal Data is mandatory for the App to deliver it's "services", then make crystal and in that case Consent is (in the majority of Apps' cases) the Lawful Base.
Not asking for Consent and enabling at a later stage the user (Data Subject) to opt-out is "consent by default" which under GDPR does not exist.
Users will provide their Consent and then they may also opt-out in the future; starting to process their Personal Data with no established Lawful Base and then (maybe) they will opt-out = unlawful Processing = GDPR breach.
