App privacy: how to make your app GDPR-compliant

Why app privacy needs extra attention

A phone knows a lot about a person. Where they are, who they're in touch with, which photos they take. With permission, an app can access all of that. That means an app can quietly collect far more data than a website.

Apps are also often built with ready-made building blocks from other companies, for example for statistics, crash reports or advertising. Some of those building blocks send data to their own servers. As the app owner, you're responsible for that too. So a privacy-friendly app starts with one question: which data leaves the phone, and where does it go? Once you have that overview, the rest of the rules are much easier to handle.

What does the GDPR require of your app?

The basic GDPR rules apply to apps just as much as to websites. Applied to your app:

• A clear purpose: only collect data you really need for the app's features.
• A valid legal basis: for example because it's needed to process an order, or because the user gives consent.
• Transparency: a privacy policy that can be reached from inside the app and explains in plain language what you do. See also privacy policy for your website.
• Security: data is sent and stored encrypted, and only the people who need it can access it.
• User rights: people must be able to view, correct and delete their data.
• Agreements with companies that process data for you, such as your hosting or an analytics service. This is called a data processing agreement.

Do you process sensitive data, such as health information, or track locations on a large scale? Then you may need a DPIA. That's a risk assessment you carry out in advance. For tracking on the phone itself, similar to cookies on a website, you usually need consent as well.

App permissions: camera, location and notifications

To access the camera, location, contacts and notifications, among other things, your app has to ask the user for permission. iOS and Android show a standard pop-up for this. How you handle it has a big effect on trust:

• Only ask for permission at the moment the feature is needed, not all at once the first time the app opens.
• Explain why in one sentence beforehand, for example 'we use your location to show the nearest branch'.
• Ask for location while the app is in use rather than all the time in the background.
• Make sure the app keeps working if someone says no, perhaps with an alternative such as entering a postcode.
• Never ask for access the app doesn't actually use. The stores check for this too.

What do Apple and Google require for app privacy?

Besides the GDPR, the app stores have their own rules. Your app is only accepted once these are in order:

• Privacy labels: in the App Store you state which data your app collects and why. Google Play asks the same in its Data safety section. This information is shown with your app in the store.
• App Tracking Transparency: on the iPhone you must ask for permission if you track users across other companies' apps and websites, for example for advertising.
• A link to your privacy policy, both in the store and in the app.
• Account deletion: if people can create an account in your app, they must also be able to delete that account themselves.

Note: those labels must also be accurate for the third-party building blocks in your app. Ask your developer for an overview of which services receive which data. Read more about submitting your app in getting your app into the App Store.

Privacy by design: how to build a privacy-friendly app

Privacy by design means you include privacy in the design from the start, instead of bolting it on afterwards. That's cheaper and gives you a better app. In practice:

• Only ask for what you really need at sign-up. An ordering app rarely needs a date of birth.
• Don't keep data longer than necessary and delete old data automatically.
• Use analytics services set up to be privacy-friendly, without full IP addresses or user profiles.
• Choose hosting and services within the European Union where possible.
• Don't store sensitive data unencrypted on the phone itself.
• Make sure login is secure, ideally with two-factor authentication. Read more about login and two-factor authentication.

Common app privacy mistakes

• Asking for every permission as soon as the app opens for the first time.
• Adding advertising or analytics building blocks without knowing what data they share.
• Privacy labels in the stores that don't match what the app actually does.
• No way to delete an account and the data that goes with it.
• A privacy policy that only covers the website and forgets the app.
• Using real customer data as test data during development.

App privacy at Violexa

At Violexa we include privacy from the very first design. We only ask for data that's needed, choose EU-based services where possible and make sure permissions and privacy labels match what the app does. We don't give legal advice, but we're happy to give your lawyer a clear overview of which data the app processes. Read more about our approach under websites and apps.

A custom project starts from €1,799 excl. VAT (€2,177 incl. VAT). Larger apps get a fixed price in writing up front.

Want to know whether your app idea or existing app handles privacy properly? Book a free quickscan. In 30 minutes, online or at your location, we take a look with you. Afterwards you get short written advice with a price indication, with no obligation.

Frequently asked questions