Let's say AdMob is used in a mobile app. AdMob collects data and transfers it to Google. There is no longer any access possible to the data by the developer. Is the app creator liable for Google's use of the data?
asked Oct 29, 2020 at 18:52
-
IFAIK, it would already not be allowed to publish an app in the EU that sends personal data of the user to Google. So the app creator already made a mistake when publishing the app.– Martin RosenauOct 29, 2020 at 19:25
-
Then what about the vast ocean of apps that use AdMob without any GDPR consent!!– rightlifesavecompenthusiastOct 29, 2020 at 19:37
-
They are sending IP address to Google and not even asking about age.– rightlifesavecompenthusiastOct 29, 2020 at 19:38
-
It depends on what "sending IP address" means: 1) The app determines the IP address of the own device and sends it to Google: This would definitely be forbidden. 2) The app "only" loads some file from the internet: There was some article on the web site of the German publishing company "Heise" about this topic (unfortunately in German language) Obviously, some lawyers say that this is not allowed, however, their argumentation published on the "Heise" site is based on a wrong premise about how the Internet works. So it is not known...– Martin RosenauOct 29, 2020 at 20:04
-
So is using AdMob without GDPR notice legal?– rightlifesavecompenthusiastOct 29, 2020 at 20:15
|
Show 4 more comments
1 Answer
A data controller is whoever determines the means and purposes of processing. It is possible that multiple controllers jointly determine the means and purposes. However, someone can only be controller over processing activities where they actually have the ability to influence these decisions (see e.g. the Fashion ID case).
The provider of an app does not have any control over what Google does on its servers with the collected data, unless Google were a data processor for that particular processing activity. Thus, the app provider is not a data controller for Google's subsequent processing, and is not responsible for Google's GDPR compliance.
HOWEVER, the app provider is a data controller regarding what happens within the app (including any SDKs, libraries, or frameworks). The app provider is data controller for processing activities such as “collecting data” and “sending data to Google”. These processing activities must comply with the GDPR (if GDPR applies), for example they need a legal basis. Under some circumstances there might be a legitimate interest for sending data to another data controller. But in the context of behavioural advertising, such a legitimate interest would be very weak and would not pass the required balancing test. Instead, the app provider would likely have to collect consent.
This is very similar to the question of whether a website can embed content from Google services such as YouTube videos, which would necessarily share data with Google. I have written related answers here and there.
You are correct that many apps do not collect valid consent before showing ads. GDPR/ePrivacy enforcement in this space is rather lacking, especially since many offenders are outside of the EU. However, this doesn't mean such illegal data processing by apps would be OK.
-
I'm glad I could resolve the question. But do not forget the third paragraph: You're not responsible for what Google does as a controller, but you're not necessarily allowed to share data with Google in the first place. The Fashion ID case is very relevant here, though it is about a slightly different scenario: the question whether a website is a data controller for processing that occurs through embedding a Facebook “Like” button.– amonNov 5, 2020 at 15:28
-
So I can send a quaterly email to google stating GDPR regulation to ensure I have reminded all my controller of their responsibility. Nov 5, 2020 at 15:37
-
The only doubt(not related to this question that remains) (which I am not asking now) is are hosting providers responsible as data controllers for ip address logs (for static github pages website) which I guess is yes. Nov 5, 2020 at 15:39
-
@compenthusiast Hosting providers should be data processors acting on your behalf, not controllers acting on their own behalf. As to regularly sending a GDPR reminder to Google, another controller: what purpose would that serve? It seems rather pointless.– amonNov 5, 2020 at 20:21
-