internet software privacy gdpr human-rights
Opt Out Consent under GDPR
<p>I am having an Android App which uses certain service such as Analytics, Ad Networks.</p>

<p>I am taking the consent from the user at when the app starts, i.e. before collecting any info.</p>

<p>But there are some services that I need in order for the app to function properly without which my making app is of no use, such as Ad Networks.</p>

<p>If I mention in my privacy policy  that "If you want to revoke your consent then your right to continue using the service ceases", will this be a valid option to revoke the consent? Or is there anything wrong if the users has to delete the app from his phone to revoke his consent?</p>

<p>First, as noted <a href="https://law.stackexchange.com/a/28609/957">elsewhere</a>, consent is not a mandatory requirement for processing of personal data under GDPR.</p>

<p>However if you are going to use consent as your legal basis for processing, then you need to make sure (as noted by @MSalters in a comment to your question) that: "Consent must be freely given and specific".</p>

<p><em>Specific</em> means that consent must be granular, so you need a separate consent for each purpose for which you collect personal data. I.e. you need one consent for "Analytics" and another one for "Ad Networks".  Then for each purpose you collect data, you must state, <em>what</em> personal data you collect for what specific <em>purpose</em> you collect this particular data.  I shall assume that your consent form is already designed to be specific, or that you can alter it to meet this requirement.</p>

<p>The second requirement is <em>freely given</em>, and it is a much more problematic requirement from your point of view.  What this really means is described in <a href="https://gdpr-info.eu/recitals/no-43/" rel="nofollow noreferrer">Recital 43</a>. It says that consent is <em>not</em> freely given:</p>

<blockquote>
  <p>if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</p>
</blockquote>

<p>This means that that you do <em>not</em> have the right to say: "if you revoke consent, your right to continue to use this service ceases", <em>unless</em> it is  practically <em>impossible</em> for you to provide the service without the user's consent.</p>

<p>I can imagine <em>some</em> service where this may be the case. For instance, if your service is to provide personalized book recommendations based upon what books the user has previously indicated he or she "liked" – you cannot do this <em>unless</em> the user consent to you keeping track of "likes".</p>

<p>However, for the majority of "free" services that are provided in exchange for personal data, this will not be the case.  In these cases the user may refuse or withdraw consent, and still have the right to access and use the same service.  That is: He or she cannot be refused service, or be required to delete the app, when the user refuses or withdraws consent.</p>

<p>I think there is broad consensus that this aspect of the GDPR is going to massively disrupt many successful pre-GDPR business models based upon personal data being commodified and used to pay for some free service.</p>

<p>While it may be "necessary" for a business to make money in order to stay in business, this is not "necessary" according to the GDPR. In "Opinion 4/2017 - on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content", the <em>European Data Protection Supervisor</em> writes:</p>

<blockquote>
  <p>There might well be a market for personal data, just like there is, tragically, a market for live human organs, but that does not mean that we can or should give that market the blessing of legislation. One cannot monetise and subject a fundamental right to a simple commercial transaction, even if it is the individual concerned by the data who is a party to the transaction.</p>
</blockquote>

<p>Of course, I don't know the specifics of your app, so I have no way of knowing whether whether the personal data you collect really are "necessary" for the app to work.  If they are necessary, it is OK to <em>not</em> provide the service to users who do not consent to the ToS.  But if they are only necessary for you to make a profit, or some other commercial purpose, you may need to rethink your business model.</p>
