We're implementing the EU's GDPR regulations on a certain project and I'm wondering about the following:
Company A develops an App, which also has a website version available to customers. The website implements a mechanism that allows the user to disable tracking and data collection. This decision is made when they land on the website, regardless of whether they are logged in at the time or not. Practically, it is very probable that large portion of users will land on the website, click "Allow all" and then log in.
I have two questions:
- When they log in, can we presume their approval of data collection is still applicable, if we can make the connection between them accepting it before they logged in and their user profile now that they did log in?
- Regardless of whether they accept or decline, is the mobile app required to adopt that decision? For example, user opted to deny any data collection by clicking on "Decline" on the website. They then logged in. After a while, they opened their mobile app on their phone (native app). What should the app do? Should it ask for permission again, since it is a different platform? Should it be able to communicate with the API and understand that the user opted out?
Again, I'm not asking from UX perspective. I'm asking from legal perspective. Is there any specific scenario in this case that we are supposed to follow by law?