privacy payment
Does adding an In-app purchase to my Google Play app require any additional privacy requirements?
<p>Suppose that a developer has  created an android app. It doesn't collect any user data except that when a user clicks on advertisements, some information is shared with  to third party companies like Google.</p>
<p>Now suppose the developer adds an  in-app purchase feature to the app (managed by Google Play). Does this change impose any  additional legal requirements to add something to the apop's privacy policy or anywhere else?</p>

<p><a href="/questions/tagged/gdpr" class="post-tag" title="show questions tagged &#39;gdpr&#39;" aria-label="show questions tagged &#39;gdpr&#39;" rel="tag" aria-labelledby="gdpr-container">gdpr</a></p>
<h2>GDPR</h2>
<p>This depends on what data protection laws apply, if any. For purposes of this answer I will assume that the GDPR applies, either because the app operator (who may or may not be the same as the developer) is located in the EU or UK, or because the operator has &quot;targeted&quot; a jurisdiction where the GDPR applies, and at least some of the users a located in such a jurisdiction. Another data protection law may apply instead, in which case the rules will be more or less different. In some cases no such law will apply at all.</p>
<h3>Lawful basis</h3>
<p>Under the GDPR, and particularly under <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6</a>, the Data Controller (DC) must specify the purpose of, and a lawful basis for, any processing of Personal Data (PD) Paragraph 1 of <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">Article 4</a> defines personal data:</p>
<blockquote>
<p>&quot;personal data&quot; means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ...</p>
</blockquote>
<p>That would include &quot;user data&quot;, the user's IP address, and other information that is related to the user, including the user's choices and activities while using the app.</p>
<p>A plausible basis might well be item (b):</p>
<blockquote>
<p>processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject ...</p>
</blockquote>
<p>Or it might be item (a), consent. The other possible lawful bases do not seem likely to apply in the situation described in the question.</p>
<h3>Informing the Data Subject</h3>
<p>Under <a href="https://gdpr-info.eu/art-13-gdpr/" rel="nofollow noreferrer">article 13</a> and <a href="https://gdpr-info.eu/art-14-gdpr/" rel="nofollow noreferrer">article 14</a> of the GDPR, the DC must provide a variety of intimation to the DS whenever PD is collected, either from the DS or from a third party. This includes the purpose(s) of the processing as well as the lawful basis. It also include who is going to receive the PD, and whether it will be transferred to a third country.</p>
<p>The GDPR does not specify exactly how this information must be provided, whether it must be in a privacy policy, or in a TOS document, or sent individually to the DS, or in some other way. But it must  be provided, and must be provided &quot;in a concise, transparent, intelligible and easily accessible form, using clear and plain language&quot; according to [Article 12]((<a href="https://gdpr-info.eu/art-12-gdpr/" rel="nofollow noreferrer">https://gdpr-info.eu/art-12-gdpr/</a>). A privacy policy might well be a good way to provide this information.</p>
