0

I am developing a free, non-commercial Android App that does not use Ads or in anyway attempt to share their information with a third-party. However, I would like to include both Google Analytics and Firebase Crash Reporting which will collect anonymous data on app usage and report any issues with the app if it crashes. The information is only being collected for myself and is not intended to include any personally identifying information like names, emails, phone numbers, etc. It may include some unintended hints at a rough location.

I should add, both Google Analytics and Firebase Crash Reporting are opt-in and are not enabled until and when the user checks a box and saves it. The app is fully functional without it enabled.

I am trying to generate a private policy for it using a service that generates a privacy template based on a questionnaire. Certain answers to that questionnaire also increase the price of retrieving that policy. It is asking me whether I want to include wording for GDPR, CalOPPA, and CCPA, and I am not sure if or which of those I actually need. I suspect I'll need to include GDPR, but I'm not completely sure. The last two both cover California and it's not clear to me how they would apply for a non-commercial, no-ads free app.

What's the simplest way to make sure my app has an appropriate privacy policy?

Improve this question
3
  • 1
    You need to be careful with the definition of “anonymous“ and the assumption that you are not collecting any personal data as an IP address can be.
    – Relaxed
    Jul 19, 2022 at 22:43
  • Where is your app hosted? Keep in mind that in most cases EU data must remain in EU and cannot be simply hosted/transferred to the US or other less privacy-sensitive jurisdictions without explicit consent by the users. See for example here: garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/… . Moreover users should be able to refuse using analytics and you still must allow them to use your service since analytics are not necessary to offer your service
    – GACy20
    Jul 20, 2022 at 10:20
  • @GACy20 The app itself is run locally on the person's Android App, but the analytics and crash report data is uploaded to Firebase/Google servers using their service and presented as an anonymized report to me. While I said I was not using any third-parties in my OP, after further thought, I think my use of Firebase/Google servers means a third-party is involved though I am the only consumer of the data to my knowledge. I should probably review their policies, though.
    – penguin359
    Jul 20, 2022 at 20:59

1 Answer 1

Reset to default
5

The CCPA is in many ways similar to the GDPR. It applies to firms that profess the personal data of California citizens, just as the GDPR applies to firms that process the data of EU residents. If you expect to have any significant number of users from California you will probably we wise to comply. Fortunately, most of the needed steps to comply with the CCPA will also be needed to comply with the GDPR, there should be little additional effort needed.

Even a site that hosts no ads and sells no information must still do some things to comply.

The California Online Privacy Protection Act of 2003 (CalOPPA) primarily requires that a site include a clear privacy policy, and there there be an easily found link to such a policy from a sites main or home page. According to the Wikipedia article linked above:

Neither the web server nor the company that created the website has to be in California in order to be under the scope of the law. The website only has to be accessible by California residents.

The law apparently does not contain any enforcement provisions of its own. The Wikipedia article states that:

CalOPPA is expected to be enforced through California's Unfair Competition Law (UCL), which prohibits unlawful, unfair, or fraudulent business acts or practices. UCL may be enforced for violations of CalOPPA by government officials seeking civil penalties or equitable relief, or by private parties seeking private claims.

Thus CalOPPA is not really a Data Protection law like the GDPR or the CCPA. Rather it requires disclosure of privacy practices, whatever they may be.

See Also "Making your Privacy Practices Public" by KD Harris.

Improve this answer
3
  • Any idea on CalOPPA or how it differs from the CCPA since both are California State laws?
    – penguin359
    Jul 20, 2022 at 21:01
  • I do find it interesting that I can find almost 100 questions on CCPA on this site, but searching for CalOPPA or OPPA, only own question shows up.
    – penguin359
    Jul 20, 2022 at 21:03
  • 1
    @penguin359 I have added information about CalOPPA to this answer. It appears that its only effect is to require a published privacy policy. There seems little to ask about this law, which probably accounts for the small number of questions here.
    – David Siegel
    Jul 20, 2022 at 21:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .