internet software privacy gdpr consent
User consent required under GDPR
<p>I am having an Android app which uses certain Analytics services such as Google Analytics, Firebase etc. These services collect certain information from the user.</p>

<p>For this reason I have drafted a Privacy Policy for my Android app. Now whenever the app starts I am asking the users consent(only once) using a tick box which IS NOT PRECHECKED.</p>

<p>Now I am having certain questions -</p>

<p>1) Can I use an pre checked tick box under GDPR?</p>

<p>2) Since GDPR also requires the data collector to ensure that the user is not under the age of 13 so I am planning to ask the users age only for that region i.e. EU Region. Now will simply mentioning that <strong>"By continuing you acknowledge that you are above 13 years"</strong> will work or will I have to ask the users age?</p>

<p>3) The GDPR requires the data collector to have a proof of the users consent. Now what kind of proof will be required for my App? I am ensuring that the user cannot move forward without providing the consent(only once) is that sufficient as a proof or is any other proof required?</p>

<p>Any answer would be really helpful.</p>

<p>"1) Can I use an pre checked tick box under GDPR?"</p>

<p>Nope.</p>

<blockquote>
  <p>"Silence, pre-ticked boxes or inactivity should not therefore constitute consent." (Recital 32)</p>
</blockquote>

<p>"2) Since GDPR also requires the data collector to ensure that the user is not under the age of 13 so I am planning to ask the users age only for that region i.e. EU Region. Now will simply mentioning that "By continuing you acknowledge that you are above 13 years" will work or will I have to ask the users age?"</p>

<p>You have to require some affirmative action.  Implicit consent (just continuing) is not acceptable (ibid.)</p>

<p>"3) The GDPR requires the data collector to have a proof of the users consent. Now what kind of proof will be required for my App? I am ensuring that the user cannot move forward without providing the consent (only once) is that sufficient as a proof or is any other proof required?"</p>

<p>If you are collecting data about the user, you should record the time and date consent was given as part of the user profile.</p>

<p>If you are <em>not</em> collecting data about the user (this is <em>only</em> done by third party services such as Google analytics etc.) and there are no user profile, then preventing the user from using the app will have to do.  The GDPR also requires data-minimization, and creating a user profile to record consent when no user profile is otherwise required will violate data-minimization-principles.</p>
