4

For my mobile app, I need to get users' consent to process their personal data (and separately to use anonymized data for Google Analytics). I am unsure, however, how exactly I have to implement this.

  1. I could ask for consent when a user is signing up and that consent is then linked to this specific user.
  2. I ask for consent when an app is first opened and save this consent option on the device (and log this choice whenever an account is logged in on this device).

Option 1 would be preferred since it is easier to implement technically, but I am not sure whether it is valid GDPR-wise. Someone could have created an account on device X and then download the app on device Y and login with the account created on device X. In this case, no consent would have been given on device Y.

My question is 1. whether option 1 still would be valid according to the GDPR, and if not, whether option 2. is a viable alternative. If not, any advice on how it should be ideally handled is appreciated.

2
  • Are you going to store the login data on the device (for faster logins)?
    – PMF
    Commented Oct 4, 2022 at 11:29
  • I use Firebase Auth for that. This means the user logs in only once, and the session is managed by the service (via a token) (for more info on this, firebase.google.com/docs/auth/admin/manage-sessions?hl=en). In short, I do not store the login data on the device.
    – TjardL
    Commented Oct 4, 2022 at 12:02

1 Answer 1

6

Either approach can be GDPR-compliant.

An issue to consider is that you as a data controller relying on consent “shall be able to demonstrate that the data subject has consented to processing of his or her personal data” (Art 7(1)). This might be simpler if a record of the consent is linked to a user account.

On the other hand, the GDPR's data minimization principle would suggest that decentral, offline approaches are preferable.

So you do have some flexibility here, as long as you feel comfortable demonstrating that your approach is compliant when investigated by a supervisory authority.

In many cases, consent is not an appropriate legal basis to start with. It is one of several options in Art 6(1) GDPR.

  • If a data processing activity is necessary for fulfilling a contract with the data subject, then Art 6(1)(b) is more appropriate.
  • If the processing is necessary for a legitimate interest, then Art 6(1)(f) would work – after conducting a balancing test.
  • Art 6(1)(a) consent is appropriate when the processing activity is not necessary, or when a legitimate interest balancing test doesn't go in your favor, or in some cases when required by law. For example, consent is required when processing special categories of data (such as biometrics), or when accessing or storing information on the end user's device, beyond what is necessary for a service explicitly requested by the user (the “cookie law”, but much more general than cookies).

Consent also has heightened compliance requirements compared to other legal bases. The data subject must be able to make a free decision, without any coercion. You must not use dark patterns. You must leave the data subject a real choice. You must not make access to your app conditional on giving unrelated consent (like providing access to a game only when the user gives consent for personalized ads). The data subject must be able to easily withdraw consent later, without suffering detriment for this.

The EDPB has issued relevant guidelines that might be helpful here:

  • EDPB guidelines 05/2020 on consent

  • EDPB guidelines 2/2019 on Article 6(1)(b) in the context of online services (also relevant for apps)

    TL;DR: what is “necessary” for performance of a contract is an objective question, and should generally be considered from the data subject's perspective. It is not possible to circumvent consent requirements by putting unrelated processing purposes like “analytics” into a services' terms of service. The main purpose of this document is to serve as a rebuttal of Facebook's GDPR compliance strategy.

    But it's perfectly fine to avoid asking for consent for those processing purposes that are actually necessary for the user.

I've noticed that you mentioned various Google services like Analytics and Firebase. To the degree that your use of these services implies an international transfer of personal data into the US, it might be impossible to be GDPR-compliant. Be wary of claims that you're only transferring “anonymous” data, as the GDPR has a fairly broad concept of identifiability.

3
  • Thanks for your elaborate answer (and answering even more ;). You are right, that the personal data I intend to collect will fall under the lawful basis contract. But I will also collect health data for which I then need explicit consent, thats why I left personal data in the title. Concerning the Google services I use, I am making sure that these services do not transfer the data to the US. And in Google Analytics, it is possible to activate IP anonymization (plus I use pseudonymization), but I will spend some time regarding Google Analytics again.
    – TjardL
    Commented Oct 4, 2022 at 12:48
  • 1
    @TjardL As of 2022, there is a increasing consensus across European data protection authorities (in particular Austria, France, Denmark) that Google Analytics cannot be used in general. IP anonymization is not sufficient, because it is only applied after the personal data has been transferred into the US – and because it only affects the user's IP address, not other personal data in the hits.
    – amon
    Commented Oct 4, 2022 at 13:36
  • Okay, that's good to know. I am not heavily relying on it. So I´ll better leave my hands off it till they do something. Most other Firebase Services processes data (by my choice only in the EU). Only Firebase Auth processes the data exclusively in the US, which is again personal data. I might also consider changing to a different provider for authentication then (after reading your answer from here
    – TjardL
    Commented Oct 4, 2022 at 14:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .