A person A makes an app and publishes it to play store. The app requests a page from a server not under his control as a part of the app . The users ip address is transmitted and logged in the servers logs and the data controller meaning the app developer has know that he has no control on it .Recieves a request from an user to delete ip logs under GDPR . What must the person do? GDPR states that as the data controller he must delete server logs but he cannot. The server talked about here is time.google.com.

  • Add a comment if any more clarification is needed . Nov 4, 2020 at 18:42
  • Will respond as soon as comment is seen. Nov 4, 2020 at 18:42
  • 2
    You are drastically simplifying what the GDPR requires - multiple entities can be both "Data Controller" and "Data Processor" or one or the other. You need to work out in your example who is acting as which, because it changes the outcome and what actions are needed to be taken.
    – user28517
    Nov 4, 2020 at 19:40
  • Can you explain further. Take an app asking time from time.google.com and google logging the ip as example. Nov 4, 2020 at 19:43
  • 4
    Why do you think you have to comply with the erasure request? There are plenty of GDPR compliant reasons why you don’t. Maybe you need to read the regulation gdpr-info.eu
    – Dale M
    Nov 4, 2020 at 21:34

1 Answer 1


Art. 17 GDPR Right to erasure (‘right to be forgotten’) can be found here. I could not find an article which would easily protect you in the scenario, but I would by happy if somebody could share such information.

I think a technical solution for your scenario would be e.g. if your app visits the external link via an application server which is under your control. By doing so the external server only logs your server's IP address, and only you log the App's IP address which is now under your full control.

This relates to "Deep-Linking" and there are discussions (e.g. in Germany) if this is legal or not, especially concerning copyright or if you use this technique to circumvent access to the external webpage. One blog in German says (Google translation):

Deep-linking banned after all? Since the "Paperboy" decision of the Federal Court of Justice (BGH) in 2003, it has been known that deep linking is generally permitted. Now the Karlsruhe judges have recently issued a new judgment and thereby considerably restrict the possibility of deep linking. After that, it is sufficient for the site operator to be linked to use session IDs to classify a deep link as a copyright infringement.

More about legal issues with deep linking are summarized here.

Another possible solution would be to start the web browser on your phone via your app and let it handle the visit to the external webpage. But this is maybe not the user experience which you had in mind with your app.

  • Yeah that is deffinitely a solution(first one you proposed) the only thing is GDPR is imposing many requirements that is making owning a server compulsory.By the way if a provide a link to the site and keep a button for the user to press instead of auto. Nov 22, 2020 at 8:29
  • That would probably bypass gdpr as user would be data controller. Nov 22, 2020 at 8:30
  • I am not sure if such a button would bypass GDPR, but I would appreciate it if someone can comment on this. I think in this case you would operate like a browser.
    – UweD
    Nov 22, 2020 at 8:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .