2

On Android, we do not need to explicitly ask a user to opt into push notifications. They are presumed to be opted in and can manually opt out. This is different from iOS where users must explicitly opt in.

Is opting users into Android push notifications automatically a violation of GDPR?

1
  • Who are they that 'presumed to be opted in'? Far to many visits to sites from a Google search result lead to a popup requests for push notifications (and adding to the homepage) on Android (in Germany) when visiting a site for the first time. They are not needed to read the page to see if it is something of interest. The same for the forms for cookie settings (that look like a tax return applications) only lead (for me at least) to leave the site. Oct 7 at 13:25
1

I would expect that this depends on the purpose for which push notifications are used.

  • There will be absolutely no problem where the push notification is strictly necessary to provide a service explicitly requested by the user.

  • In case the push notifications are used for marketing purposes, I would be inclined to consider push notifications to be effectively equivalent to electronic mail. Then, per Art 13 of the ePrivacy Directive:

    • Sending marketing messages requires consent.

    • You may market your own similar products or services to existing customers, as long as the recipient is given an opportunity to opt out in each message and when the contact details where initially obtained.

      In order to let the user opt out for each message, your app should provide sufficiently fine-grained notification categories that distinguish between marketing notifications and functional notifications.

      The contact details for sending push notifications are obtained through APIs, which probably means that the app should present an opt-out screen for such notifications before push notifications are sent. The possibility to opt out must not be hidden in fine print but must be presented “distinctly”.

  • Alternatively, we can consider push notifications to require access to or storage of information on the end user's device. This would trigger the rules in Art 5(3) of the ePrivacy Directive which allows such access and storage as strictly necessary and as technically necessary, but otherwise requires consent. This largely produces the same consequences as the “electronic communications” interpretation, but without the exception for marketing similar products or services.

As ePrivacy is a directive, each EU/EEA member state (and the UK) have their own national implementation. If you are in the EU/EEA, you only have to consider the implementation in your EU/EEA country with respect to users in the EU/EEA:

you are in … user in EU/EEA user in UK user elsewhere*
…EU/EEA follow your own country's rules follow UK rules follow your own country's rules
…UK follow each user's country's rules follow UK (your) rules follow UK (your own) rules
…elsewhere follow each user's country's rules follow UK rules no obligations

* other countries might impose rules of their own. The table only accounts for consequences from EU/EEA/UK law.

GDPR obligations are on top of ePrivacy obligations, but they are somewhat complementary. Sending push notifications likely involves processing of personal data, since I'd consider the push notification token to be an identifier. Processing personal data requires an Art 6 GDPR legal basis, such as necessity for performing a contract with the user, a legitimate interest, or consent. In some cases outlined above, the ePrivacy directive may mandate that you use consent. The GDPR also defines conditions for consent in Art 7.

1
  • This was really valuable insight, thank you.
    – user41191
    Oct 7 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.