I saw this thread where it's possible to use Google Analytics without consent on websites: Is it really possible to use Google Analytics without consent, and if so, why exactly?
My question is: does this still apply to mobile applications? Are there changes to be made?
There are two relevant EU laws: GDPR and ePrivacy.
Using Google Analytics does not require consent as far as the GDPR is concerned. The processing can instead be based on legitimate interest, but you do have to offer opt-out and must use suitable security measures, for example by signing the data processing agreement with Google. Alternatively, an argument is possible that the collected data doesn't qualify as personal data – but I don't think that argument is correct.
The ePrivacy directive is more tricky. It is not directly enforceable law. Instead, directives are implemented through member state law. As a result, there can be subtle differences between member states. What one data protection authority allows is not necessarily relevant in another country.
ePrivacy requires you to collect consent when you access information on the user's device, for example when you read or write cookies or use similar technologies, regardless of whether the information is personal data in the sense of the GDPR. The only exception is when the access is strictly necessary for your application – but that doesn't cover analytics. This ePrivacy requirement is the source of all the cookie consent banners you see on the web.
Google Analytics stores a Client ID on the user's device, which is used to combine separate events into a session or user profile. Optionally, this Client ID can be linked with a User ID, which lets you track a signed-in user across devices.
But storing/acessing this Client ID requires consent under ePrivacy.
If you want to avoid asking for consent, you must disable storage of the Client ID. On the web, this can be reached by setting 'storage': 'none' for analytics.js or 'client_storage': 'none' for gtag.js. I use this approach on my personal website, with the result that “pageviews” and “sessions” are now synonymous. I am not sure what the equivalent would be on mobile, but the same concerns apply.
I assume (but do not know for sure) that the consent requirement only applies to persistently stored data. Keeping a transient User ID in memory is likely fine. That would let you correlate events into a session while the app remains open, without having to ask for consent.
