Either approach can be GDPR-compliant.
An issue to consider is that you as a data controller relying on consent “shall be able to demonstrate that the data subject has consented to processing of his or her personal data” (Art 7(1)). This might be simpler if a record of the consent is linked to a user account.
On the other hand, the GDPR's data minimization principle would suggest that decentral, offline approaches are preferable.
So you do have some flexibility here, as long as you feel comfortable demonstrating that your approach is compliant when investigated by a supervisory authority.
In many cases, consent is not an appropriate legal basis to start with. It is one of several options in Art 6(1) GDPR.
- If a data processing activity is necessary for fulfilling a contract with the data subject, then Art 6(1)(b) is more appropriate.
- If the processing is necessary for a legitimate interest, then Art 6(1)(f) would work – after conducting a balancing test.
- Art 6(1)(a) consent is appropriate when the processing activity is not necessary, or when a legitimate interest balancing test doesn't go in your favor, or in some cases when required by law. For example, consent is required when processing special categories of data (such as biometrics), or when accessing or storing information on the end user's device, beyond what is necessary for a service explicitly requested by the user (the “cookie law”, but much more general than cookies).
Consent also has heightened compliance requirements compared to other legal bases. The data subject must be able to make a free decision, without any coercion. You must not use dark patterns. You must leave the data subject a real choice. You must not make access to your app conditional on giving unrelated consent (like providing access to a game only when the user gives consent for personalized ads). The data subject must be able to easily withdraw consent later, without suffering detriment for this.
The EDPB has issued relevant guidelines that might be helpful here:
EDPB guidelines 05/2020 on consent
EDPB guidelines 2/2019 on Article 6(1)(b) in the context of online services (also relevant for apps)
TL;DR: what is “necessary” for performance of a contract is an objective question, and should generally be considered from the data subject's perspective. It is not possible to circumvent consent requirements by putting unrelated processing purposes like “analytics” into a services' terms of service. The main purpose of this document is to serve as a rebuttal of Facebook's GDPR compliance strategy.
But it's perfectly fine to avoid asking for consent for those processing purposes that are actually necessary for the user.
I've noticed that you mentioned various Google services like Analytics and Firebase. To the degree that your use of these services implies an international transfer of personal data into the US, it might be impossible to be GDPR-compliant. Be wary of claims that you're only transferring “anonymous” data, as the GDPR has a fairly broad concept of identifiability.
