gdpr privacy consent
GDPR - Consent to the use of personal data on mobile app - stored per device or signed up user?
<p>For my mobile app, I need to get users' consent to process their personal data (and separately to use anonymized data for Google Analytics). I am unsure, however, how exactly I have to implement this.</p>
<ol>
<li>I could ask for consent when a user is signing up and that consent is then linked to this specific user.</li>
<li>I ask for consent when an app is first opened and save this consent option on the device (and log this choice whenever an account is logged in on this device).</li>
</ol>
<p>Option 1 would be preferred since it is easier to implement technically, but I am not sure whether it is valid GDPR-wise. Someone could have created an account on device X and then download the app on device Y and login with the account created on device X. In this case, no consent would have been given on device Y.</p>
<p>My question is 1. whether option 1 still would be valid according to the GDPR, and if not, whether option 2. is a viable alternative. If not, any advice on how it should be ideally handled is appreciated.</p>

<p>Either approach can be GDPR-compliant.</p>
<p>An issue to consider is that you as a data controller relying on consent “shall be able to demonstrate that the data subject has consented to processing of his or her personal data” (Art 7(1)). This might be simpler if a record of the consent is linked to a user account.</p>
<p>On the other hand, the GDPR's data minimization principle would suggest that decentral, offline approaches are preferable.</p>
<p>So you do have some flexibility here, as long as you feel comfortable demonstrating that your approach is compliant when investigated by a supervisory authority.</p>
<p>In many cases, consent is not an appropriate legal basis to start with. It is one of several options in Art 6(1) GDPR.</p>
<ul>
<li>If a data processing activity is necessary for fulfilling a contract with the data subject, then Art 6(1)(b) is more appropriate.</li>
<li>If the processing is necessary for a legitimate interest, then Art 6(1)(f) would work – after conducting a balancing test.</li>
<li>Art 6(1)(a) consent is appropriate when the processing activity is not necessary, or when a legitimate interest balancing test doesn't go in your favor, or in some cases when required by law. For example, consent is required when processing special categories of data (such as biometrics), or when accessing or storing information on the end user's device, beyond what is necessary for a service explicitly requested by the user (the “cookie law”, but much more general than cookies).</li>
</ul>
<p>Consent also has heightened compliance requirements compared to other legal bases. The data subject must be able to make a free decision, without any coercion. You must not use dark patterns. You must leave the data subject a real choice. You must not make access to your app conditional on giving unrelated consent (like providing access to a game only when the user gives consent for personalized ads). The data subject must be able to easily withdraw consent later, without suffering detriment for this.</p>
<p>The EDPB has issued relevant guidelines that might be helpful here:</p>
<ul>
<li><p><a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en" rel="noreferrer">EDPB guidelines 05/2020 on consent</a></p>
</li>
<li><p><a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22019-processing-personal-data-under-article-61b_en" rel="noreferrer">EDPB guidelines 2/2019 on Article 6(1)(b) in the context of online services</a> (also relevant for apps)</p>
<p>TL;DR: what is “necessary” for performance of a contract is an objective question, and should generally be considered from the data subject's perspective. It is not possible to circumvent consent requirements by putting unrelated processing purposes like “analytics” into a services' terms of service. The main purpose of this document is to serve as a rebuttal of Facebook's GDPR compliance strategy.</p>
<p>But it's perfectly fine to avoid asking for consent for those processing purposes that are actually necessary for the user.</p>
</li>
</ul>
<p>I've noticed that you mentioned various Google services like Analytics and Firebase. To the degree that your use of these services implies an international transfer of personal data into the US, it might be impossible to be GDPR-compliant. Be wary of claims that you're only transferring “anonymous” data, as the GDPR has a fairly broad concept of identifiability.</p>
