Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
Suppose that a developer has created an android app. It doesn't collect any user data except that when a user clicks on advertisements, some information is shared with to third party companies like Google.
Now suppose the developer adds an in-app purchase feature to the app (managed by Google Play). Does this change impose any additional legal requirements to add something to the apop's privacy policy or anywhere else?
This depends on what data protection laws apply, if any. For purposes of this answer I will assume that the GDPR applies, either because the app operator (who may or may not be the same as the developer) is located in the EU or UK, or because the operator has "targeted" a jurisdiction where the GDPR applies, and at least some of the users a located in such a jurisdiction. Another data protection law may apply instead, in which case the rules will be more or less different. In some cases no such law will apply at all.
Under the GDPR, and particularly under Article 6, the Data Controller (DC) must specify the purpose of, and a lawful basis for, any processing of Personal Data (PD) Paragraph 1 of Article 4 defines personal data:
"personal data" means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ...
That would include "user data", the user's IP address, and other information that is related to the user, including the user's choices and activities while using the app.
A plausible basis might well be item (b):
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject ...
Or it might be item (a), consent. The other possible lawful bases do not seem likely to apply in the situation described in the question.
Under article 13 and article 14 of the GDPR, the DC must provide a variety of intimation to the DS whenever PD is collected, either from the DS or from a third party. This includes the purpose(s) of the processing as well as the lawful basis. It also include who is going to receive the PD, and whether it will be transferred to a third country.
The GDPR does not specify exactly how this information must be provided, whether it must be in a privacy policy, or in a TOS document, or sent individually to the DS, or in some other way. But it must be provided, and must be provided "in a concise, transparent, intelligible and easily accessible form, using clear and plain language" according to [Article 12]((https://gdpr-info.eu/art-12-gdpr/). A privacy policy might well be a good way to provide this information.
