Is every download from an EU country enough to put me in scope?

Not on its own. Recital 23 says it should be ascertained whether it is apparent that the controller envisages offering services to data subjects in one or more Member States, and that mere accessibility of a website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention. It then names factors that do make it apparent: the use of a language or a currency generally used in one or more Member States with the possibility of ordering in that other language, or the mentioning of customers or users who are in the Union. Monitoring is the separate trigger in Article 3(2)(b), and an analytics SDK that profiles behaviour can reach it without any of those marketing signals.

What is the difference between consent and legitimate interest for analytics?

They are two different lawful bases in Article 6(1), and they put the work in different places. Consent, point (a), is defined in Article 4(11) as any freely given, specific, informed and unambiguous indication of the data subject's wishes, by a statement or by a clear affirmative action. Article 7 adds that you must be able to demonstrate it, that the request is clearly distinguishable from other matters in clear and plain language, and that it shall be as easy to withdraw as to give consent. Legitimate interests, point (f), is available except where your interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child. Recital 47 says the existence of a legitimate interest would need careful assessment, including whether a data subject can reasonably expect, at the time and in the context of the collection, that processing for that purpose may take place. Article 21 then gives the person a right to object to processing based on point (f).

Does a cookie banner make sense inside a mobile app?

The requirement travels to the app. The banner shape does not. The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3), version 2.0, adopted on 7 October 2024, state that Article 5(3) does not exclusively apply to cookies but also to similar technologies, and that terminal equipment may be comprised of any number of individual pieces of hardware, giving smartphones as an example. On unique identifier collection on websites or mobile applications, naming both, the Guidelines say the entity collecting is instructing the browser, through the distribution of client-side code, to send that information, so a gaining of access is taking place and Article 5(3) applies. The word browser is theirs; the paragraph covers apps too. What that argues for in an app is a plain in-app screen, shown before the first SDK call that touches the device, with a real refuse option and a way back into the choice later. Not a strip of web furniture at the bottom of a screen.

Do I need a data processing agreement with every SDK vendor?

With every one that acts as your processor, yes. Article 28(3) says processing by a processor shall be governed by a contract or other legal act, binding on the processor, that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. The same paragraph lists what the contract must stipulate, including that the processor acts only on documented instructions, keeps the data confidential, assists you with data subject requests, deletes or returns the data at your choice at the end, and allows for audits. Article 28(2) says the processor shall not engage another processor without your prior specific or general written authorisation. A vendor that uses your users' data for its own purposes is not your processor at all, and Article 28 is then the wrong frame for the relationship.

What are the fines actually set at?

Article 83 has two tiers. Paragraph 4 covers the obligations of the controller and the processor under Articles 8, 11, 25 to 39, 42 and 43, with administrative fines up to 10 000 000 EUR or, in the case of an undertaking, up to 2 per cent of total worldwide annual turnover of the preceding financial year, whichever is higher. Paragraph 5 covers the basic principles for processing, including conditions for consent under Articles 5, 6, 7 and 9, the data subjects' rights under Articles 12 to 22, and transfers under Articles 44 to 49, with fines up to 20 000 000 EUR or up to 4 per cent of that turnover, whichever is higher. Consent sits in the higher tier. Those are ceilings, not tariffs, and Article 83(2) sets out what a supervisory authority weighs when it picks a number.

Is this page legal advice?

No. It is a developer's reading of primary sources, and it points at those sources so you can check every sentence against them. The Regulation is published by the EU as Regulation (EU) 2016/679 and the full text is on EUR-Lex. The guidance on what counts as storing or accessing information on a device comes from the European Data Protection Board, which publishes its guidelines in full. Both are linked on this page. For anything that depends on your own facts, including whether you need an EU representative, how you justify analytics, or what your national transposition of the ePrivacy Directive requires, get advice from a qualified lawyer in a relevant jurisdiction.

Articles · GuidesUpdated October 2026

GDPR follows your users, not your company address.

Q: Can I rely on legitimate interest and skip the analytics prompt?

Not by itself, because a second law is also in play. Article 5(3) of the ePrivacy Directive, as replaced by Directive 2009/136/EC, says the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information about the purposes of the processing. It then carves out technical storage or access for the sole purpose of carrying out the transmission of a communication, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. An analytics SDK that writes an identifier onto the phone and reads it back is doing the thing that provision names. The lawful basis under Article 6 and the consent under Article 5(3) are separate questions, and picking legitimate interests answers only the first one.

Q: Does data that never leaves the phone need consent?

The EDPB guidelines draw that line directly. They describe local applications using information strictly inside the terminal, as with smartphone system APIs for the camera, the microphone, the GPS sensor, local file access, the contact list or identifier access, and say that the use of such information by an application would not constitute a gaining of access to information already stored as long as the information does not leave the device. The sentence continues: when this information, or any derivation of this information, is accessed, Article 5(3) would apply. So a local-first app that reads a sensor and keeps the result on the phone is in a different position from one that posts a summary of it to a server. A derived value counts as much as the raw one.

Q: Do I have to appoint an EU representative?

Where Article 3(2) applies, Article 27(1) says the controller or the processor shall designate in writing a representative in the Union, and Article 27(3) says that representative shall be established in one of the Member States where the data subjects are. Article 27(2)(a) sets out the exemption: processing that is occasional, does not include on a large scale the special categories of data in Article 9(1) or criminal conviction data under Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing. An app with a steady stream of EU users is not obviously occasional. Whether yours qualifies is a judgement about your own processing, and it is the kind of judgement worth paying a lawyer for rather than reading off a page like this one.

An app with no EU company and EU users is in scope. Article 3(2) of the Regulation applies it to a controller or processor not established in the Union whenever the processing relates to offering goods or services to people who are in the Union, or to monitoring their behaviour while they are there. Being registered in Austin or Bangalore does not change that, and neither does giving the app away for free. What does change is the detail: whether you were really offering the app to those users, and which of the two triggers you hit. This page quotes the Regulation and the regulator, both read on 10 October 2026. It is not legal advice.

Then the part founders get stuck on. Analytics. There is a real choice between consent and legitimate interests under Article 6, and a second law underneath it that asks a narrower question about writing to the phone. The two are often confused, which is why the answer so often arrives as a cookie banner bolted into an app where no cookie exists.

Start here

The short version

Two laws, two questions, and people answer only one of them.

The first question is the General Data Protection Regulation. Does it reach you, and if it does, what is your lawful basis for each thing you do with personal data? Article 6(1) lists six bases. For product analytics the live options are consent, point (a), and legitimate interests, point (f). Both are real. They carry different obligations, and one of them gives the person a right to object rather than a right to refuse up front.

The second question is older and narrower. Article 5(3) of the ePrivacy Directive governs storing information on, or reading information already stored in, a user's device. It asks for consent for that act, whatever your Article 6 basis is, unless one of two narrow exemptions fits. That is the provision a cookie banner was invented for, and it is the one almost nobody remembers applies to a phone. Picking legitimate interests under Article 6 does not answer it.

Does GDPR apply if your company is not in the EU?

Article 3 has two limbs and most apps only need the second. Article 3(1) covers processing in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. Recital 22 adds that establishment implies the effective and real exercise of activity through stable arrangements, and that the legal form of those arrangements is not the determining factor. So a Delaware company with two engineers working from Lisbon is not automatically outside it.

Article 3(2) is the one that catches a solo developer. It applies the Regulation to processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union, or to the monitoring of their behaviour as far as their behaviour takes place within the Union. Note what it does not say. It says nothing about citizenship, and nothing about your registered address. It is about people who are in the Union and what you are doing to them.

The nuance sits in the recitals. Recital 23 says it should be ascertained whether it is apparent that you envisage offering services to data subjects in one or more Member States, and that mere accessibility of a website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where you are established, is insufficient to ascertain that intention. Then it names the signals that do count: the use of a language or a currency generally used in one or more Member States with the possibility of ordering in that other language, or the mentioning of customers or users who are in the Union. A German store listing and a price in euros are exactly those signals.

Monitoring is a separate door into the same room, and an app walks through it more easily than a website. Recital 24 describes working out whether natural persons are tracked on the internet, including the potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly to take decisions concerning them or for analysing or predicting their personal preferences, behaviours and attitudes. An attribution SDK that builds a per-user profile is doing that by design. One more obligation hangs off scope: under Article 27(1), where Article 3(2) applies you designate a representative in the Union in writing, unless the narrow Article 27(2)(a) exemption for occasional, low risk processing fits.

Regulation (EU) 2016/679, the official text on EUR-Lex, read 10 October 2026

Check yours

Which part of Article 3 your app touches

Tick what is true of your app today. Each line points at the paragraph or the recital that covers it, in the Regulation's own words.

Nothing ticked. An app with no establishment in the Union, no users in the Union and no monitoring of anybody in the Union sits outside Article 3. That is a fact about where your users are, not a setting you pick.

Is analytics consent, or is it legitimate interest?

Under the Regulation alone, either can work, and the difference is where the burden lands. Consent is Article 6(1)(a), and Article 4(11) defines it as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing. Article 7 then adds four conditions. You must be able to demonstrate that consent was given. A request bundled into a wider declaration must be clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. The person may withdraw at any time, and it shall be as easy to withdraw as to give. And when judging whether consent was freely given, utmost account is taken of whether the service was made conditional on consent to processing that is not necessary to provide it.

Legitimate interests is Article 6(1)(f). It allows processing necessary for the purposes of the legitimate interests pursued by you or by a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child. Recital 47 tells you how that balance is struck: take into consideration the reasonable expectations of data subjects based on their relationship with you, and note that the existence of a legitimate interest would need careful assessment, including whether a data subject can reasonably expect, at the time and in the context of collection, that processing for that purpose may take place. The same recital says the interests of the person could in particular override yours where data are processed in circumstances where they do not reasonably expect further processing.

Two practical consequences follow. Article 13(1)(c) makes you name the purposes and the legal basis at the time the data are obtained, and Article 13(1)(d) makes you name the legitimate interests themselves when you rely on point (f). Article 21(1) gives the person a right to object at any time, on grounds relating to their particular situation, to processing based on point (f), and you then have to stop unless you can demonstrate compelling legitimate grounds that override their interests, rights and freedoms. So legitimate interests is not the quiet option. It moves the work from a prompt to a written assessment and a request you have to be able to handle.

Then the part that catches people. Whichever basis you choose, the analytics SDK is still writing an identifier onto the phone and reading it back later, and that act has its own rule. The European Data Protection Board's guidelines on the technical scope of Article 5(3) of the ePrivacy Directive say that instructing the device to send already stored information, for example through a protocol or an SDK that implies the proactive sending of information by the terminal equipment, makes an intrusion into the terminal equipment possible, and that such an access triggers Article 5(3). That provision asks for consent for the act, subject to its own two exemptions. Your Article 6 basis does not stand in for it.

European Data Protection Board, Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive, version 2.0, adopted 7 October 2024, read 10 October 2026

Does a cookie banner belong inside a mobile app?

The requirement comes with you to the phone. The banner does not. Article 5(3) of the ePrivacy Directive, in the wording Directive 2009/136/EC put in place, says Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information about the purposes of the processing. Two exemptions follow: technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. There is no mention of a cookie in any of it.

The regulator is explicit about that. The EDPB guidelines say Article 5(3) does not exclusively apply to cookies but also to similar technologies, and that terminal equipment may be comprised of any number of individual pieces of hardware, listing smartphones first among its examples. The guidelines also note that the word in the provision is information, not personal data, so the trigger does not wait for anything identifiable. On identifiers specifically they say that in the context of unique identifier collection on websites or mobile applications, naming both, the entity collecting is instructing the browser, through the distribution of client-side code, to send that information, so a gaining of access is taking place and Article 5(3) applies. The word browser is theirs, and the paragraph it sits in covers apps as well.

There is a real line here, and it is about the device boundary rather than about sensitivity. The guidelines describe local applications that use information strictly inside the terminal, as with smartphone system APIs for the camera, the microphone, the GPS sensor, local file access, the contact list or identifier access, and say the use of such information by an application would not constitute a gaining of access to information already stored as long as the information does not leave the device. The next clause is the one to read twice: when this information, or any derivation of this information, is accessed, Article 5(3) would apply. The guidelines also decline to rule on the exemptions themselves, saying those have to be analysed case by case against the relevant Member State transposition.

So what belongs in an app is not a strip of web furniture. It is a plain screen, in your own design, shown before the first SDK call that touches the device, with refuse as easy to press as accept and a settings entry that lets someone change their mind later, because Article 7(3) requires withdrawal to be as easy as giving. Do not confuse it with the iOS tracking prompt either. That one asks Apple's question about tracking across apps and websites, under Apple's rules, and the app tracking transparency guide covers what it does and does not cover. Two prompts, two questions, and neither one answers for the other.

European Data Protection Board, Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive, read 10 October 2026

Do you need a data processing agreement with every SDK?

With every vendor that processes personal data on your behalf, yes, and it has to be in writing. Article 28(3) says processing by a processor shall be governed by a contract or other legal act under Union or Member State law, binding on the processor with regard to the controller, which sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. The same paragraph then lists eight things the contract must stipulate. Processing only on documented instructions. Confidentiality commitments from the people who handle the data. The security measures Article 32 requires. Help with data subject requests. Help with breach notification and impact assessments. Deletion or return of the data at your choice when the service ends. And information and audit access so you can demonstrate compliance.

Two parts of Article 28 get skipped. Paragraph 1 says you shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures, which is a selection duty before any contract is signed. Paragraph 2 says the processor shall not engage another processor without your prior specific or general written authorisation, and that under a general authorisation it must tell you about intended additions or replacements so you have the opportunity to object. That is the clause that makes a vendor's sub-processor list worth reading rather than scrolling past. Paragraph 4 keeps the first processor fully liable to you if its own sub-processor fails.

The harder question is whether a vendor is a processor at all. Article 4(7) makes the controller the one who determines the purposes and means of the processing, and Article 4(8) makes the processor the one who processes on the controller's behalf. An analytics or advertising SDK that also uses what it collects for its own purposes, across its other customers, is not acting purely on your behalf, and signing a processing agreement with it does not change what it is doing. Working out which vendors are in which category is the same inventory job as app security basics starts from: every place data leaves the device, and who holds it after that.

Small teams get one genuine break and it is narrower than it sounds. Article 30(5) says the record keeping obligations in Article 30(1) and (2) do not apply to an enterprise or organisation employing fewer than 250 persons, unless the processing is likely to result in a risk to the rights and freedoms of data subjects, is not occasional, or includes special categories of data under Article 9(1) or criminal conviction data under Article 10. Routine analytics on every session is not occasional. As for the stakes, Article 83(4) caps fines for controller and processor obligations at 10 000 000 EUR or 2 per cent of worldwide annual turnover, whichever is higher, and Article 83(5) caps breaches of the basic principles, including the conditions for consent, at 20 000 000 EUR or 4 per cent.

Regulation (EU) 2016/679, Articles 27, 28, 30 and 83 on EUR-Lex, read 10 October 2026

The two bases, side by side, and the row that undoes the shortcut

The question	Consent, Article 6(1)(a)	Legitimate interests, Article 6(1)(f)	Same answer for both
What you have to be able to show	A freely given, specific, informed and unambiguous indication of the person's wishes	An assessment of your interest against the person's rights and reasonable expectations	No
Who acts first	The person, by a statement or a clear affirmative action	You. The person reacts afterwards	No
Named in the privacy notice before you collect	Yes	Yes	Yes
Open to a public authority for its own tasks	Yes	No	No
How the person stops it	Withdrawal at any time, and it must be as easy as giving it	An objection under Article 21, which you then have to answer	No
Removes the separate device storage consent	No	No	Yes

The last row is the one that matters. Neither Article 6 basis removes the separate consent Article 5(3) of the ePrivacy Directive asks for before you store or read information on someone's device.

Where this lands if a builder generated your app

Nothing moves because an agent wrote the code. You are the controller, because you are the one who determines the purposes and means of the processing under Article 4(7), and the obligations sit with you. What changes is how fast the picture moves, because an agent can add a dependency in a sentence. The useful habit is to keep a list of every place data leaves the phone, and to update it on the same day the dependency arrives rather than the week before a submission.

Newly is an AI app builder. You describe an app in plain English and it writes a real React Native and Expo project that you own. It uploads iOS builds to TestFlight, publishes to Google Play internal testing, builds a standalone Android APK, and keeps two way GitHub sync so the code is never trapped. It does not submit to the App Store for you, because Apple requires the owner of the content to submit. It is $25 a month, with no free tier. The detail that matters here is where a generated app starts: data on the phone, no accounts, no server, no analytics SDK. On the EDPB reading above that is information which never leaves the device.

It stops being that the moment you ask for sign in, sync, a paywall or product analytics. Then a backend holds personal data, vendors become processors, Article 28 contracts are needed and the device consent question is live. The same inventory feeds the store forms too, since App Store privacy details and the Play data safety form both ask what leaves the device and who receives it. Those are store declarations, not compliance. Filling them in is not the same as having a lawful basis, and no builder can do either for you.

Questions founders ask about GDPR and mobile apps

Yes, if the app is aimed at people in the EU or watches what they do. Article 3(2) applies the Regulation to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the offering of goods or services to such data subjects in the Union, or to the monitoring of their behaviour as far as their behaviour takes place within the Union. Article 3(2)(a) adds that it applies irrespective of whether a payment of the data subject is required, so a free app is in scope on the same terms as a paid one. Nothing in Article 3 turns on where you are registered or incorporated. This is not legal advice, and the text is linked on the page.

Start local, add the server when you need it

An app that keeps its data on the phone has the shortest compliance story there is. Build that first, write down every vendor the day it arrives, and get advice from a qualified lawyer before you decide how you justify the analytics.

Start building