Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
On Android, we do not need to explicitly ask a user to opt into push notifications. They are presumed to be opted in and can manually opt out. This is different from iOS where users must explicitly opt in.
Is opting users into Android push notifications automatically a violation of GDPR?
I would expect that this depends on the purpose for which push notifications are used.
There will be absolutely no problem where the push notification is strictly necessary to provide a service explicitly requested by the user.
In case the push notifications are used for marketing purposes, I would be inclined to consider push notifications to be effectively equivalent to electronic mail. Then, per Art 13 of the ePrivacy Directive:
Sending marketing messages requires consent.
You may market your own similar products or services to existing customers, as long as the recipient is given an opportunity to opt out in each message and when the contact details where initially obtained.
In order to let the user opt out for each message, your app should provide sufficiently fine-grained notification categories that distinguish between marketing notifications and functional notifications.
The contact details for sending push notifications are obtained through APIs, which probably means that the app should present an opt-out screen for such notifications before push notifications are sent. The possibility to opt out must not be hidden in fine print but must be presented “distinctly”.
Alternatively, we can consider push notifications to require access to or storage of information on the end user's device. This would trigger the rules in Art 5(3) of the ePrivacy Directive which allows such access and storage as strictly necessary and as technically necessary, but otherwise requires consent. This largely produces the same consequences as the “electronic communications” interpretation, but without the exception for marketing similar products or services.
As ePrivacy is a directive, each EU/EEA member state (and the UK) have their own national implementation. If you are in the EU/EEA, you only have to consider the implementation in your EU/EEA country with respect to users in the EU/EEA:
| you are in … | user in EU/EEA | user in UK | user elsewhere* |
|---|---|---|---|
| …EU/EEA | follow your own country's rules | follow UK rules | follow your own country's rules |
| …UK | follow each user's country's rules | follow UK (your) rules | follow UK (your own) rules |
| …elsewhere | follow each user's country's rules | follow UK rules | no obligations |
* other countries might impose rules of their own. The table only accounts for consequences from EU/EEA/UK law.
GDPR obligations are on top of ePrivacy obligations, but they are somewhat complementary. Sending push notifications likely involves processing of personal data, since I'd consider the push notification token to be an identifier. Processing personal data requires an Art 6 GDPR legal basis, such as necessity for performing a contract with the user, a legitimate interest, or consent. In some cases outlined above, the ePrivacy directive may mandate that you use consent. The GDPR also defines conditions for consent in Art 7.
