The essentials
A mobile app that processes personal data remains fully subject to GDPR, exactly like a website. But the mobile context adds specific risks: third-party advertising and analytics SDKs that collect data without the publisher’s full knowledge, overly broad hardware permissions, ad tracking governed by Apple’s App Tracking Transparency, and privacy labels now displayed directly on the App Store and Google Play listing. Ignoring these specifics exposes a business to a GDPR fine as much as to rejection by the stores themselves.
GDPR applies to the app, not just the backend
A common mistake is thinking about GDPR compliance only at the server level (database, web forms), forgetting that the app itself collects and processes data from the moment it’s installed: advertising identifier, location data, crash logs, in-app browsing behavior. Every processing activity needs a clear legal basis, must be documented, and should stay limited to what the app actually needs to function (data minimization).
For the purely technical side of protecting that data (encryption, storage, access control), see our mobile app security page: security and GDPR compliance are complementary, the former protects the data that the latter regulates legally.
Third-party SDKs: the most underestimated GDPR risk
Most apps integrate third-party development kits for analytics, advertising, push notifications or payments. Each of these SDKs can collect and send data to its own servers, often outside the European Union, without the app’s publisher having full visibility into it.
Checks before integrating a third-party SDK: review its privacy policy and where it processes data, make sure a data processing agreement (DPA) is in place if personal data flows through it, periodically audit which SDKs are actually active in production (kits left over from a test sometimes stay active in production), and document every SDK in the processing register like any other data processor.
Consent and tracking: what iOS and Android change
| Aspect | iOS (App Tracking Transparency) | Android |
|---|---|---|
| Ad tracking framework | Explicit consent mandatory via the ATT prompt before any cross-app tracking | No single system equivalent, depends on the SDK and Google Play policy |
| Advertising identifier | IDFA inaccessible without ATT consent | Advertising ID, resettable by the user |
| Penalty for non-compliance | App rejection or removal by Apple | App rejection or removal by Google, on top of GDPR fines |
| Relevant GDPR provision | Article 6 (legal basis) and the consent recital | Same: GDPR applies regardless of OS |
Consent requested through a native prompt (ATT or an in-app GDPR banner) isn’t enough on its own: it must be freely given, specific, informed and unambiguous, which rules out biased wording (“Accept to continue” with no real alternative) already sanctioned by data protection authorities on the web and directly transferable to the mobile context.
Permissions: the principle of least privilege
Requesting access to the camera, microphone, precise location or contact list without a direct link to a feature used immediately is both a GDPR risk (disproportionate processing) and a negative signal for users, who are more likely to uninstall an app perceived as intrusive. Best practice is to request each permission at the exact moment it becomes necessary (lazy permissions), with a clear explanation of its purpose, rather than a block of requests on first launch.
Store privacy labels: transparency goes public
Since their rollout, Apple’s Privacy Nutrition Label and Google Play’s “Data safety” section display a summary of collected data and its use directly on the app listing, visible to any user before they even install it. These declarations carry legal weight: a mismatch between the declared label and the app’s actual behavior is both a violation of the store’s terms and a publicly documented sign of GDPR non-compliance.
User rights in a mobile context
The right of access, rectification and erasure applies to a mobile app just as to any other processing activity, with an added practical constraint: data can exist both on the server and locally on the device (cache, encrypted local database, temporary files). Deleting an account should therefore trigger effective erasure across both layers, not just the server-side record.
FAQ
Is strong encryption enough to guarantee a mobile app’s GDPR compliance?
No. Encryption protects data against unauthorized access, but GDPR compliance covers a much wider scope: legal basis for collection, retention period, informing users, managing access and erasure rights, contractual oversight of processors (third-party SDKs included). Encryption is a necessary building block, not a sufficient one.
Does a mobile app need a Data Protection Officer (DPO)?
It depends on the volume and nature of the data processed, not the platform (mobile or web): GDPR requires a DPO in specific cases (large-scale processing of sensitive data, regular and systematic large-scale monitoring of individuals). An SME with a standard app generally isn’t required to appoint one, but benefits from designating an internal GDPR point of contact.
Are free advertising SDKs a particular GDPR risk?
Often, yes, because their business model relies precisely on collecting and monetizing data. Every advertising SDK integrated into an app should be checked against its data processing policy and, where necessary, covered by a data processing agreement, exactly like any vendor that processes data on behalf of the app’s publisher.
Neodigit: GDPR compliance built into the mobile architecture
At Neodigit, GDPR compliance is considered from the choice of third-party SDKs and the storage architecture onward, not patched in after an audit. Our approach to application security systematically includes local data encryption, minimized permission requests and clear documentation of processing activities, for compliant apps without unnecessary complexity added after the fact.
Have an existing app to bring into compliance, or a new project to design the right way from the start? Let’s talk.