• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

User identifiers and shadow profiles under the GDPR

cnorval

Lurker
Just a PSA:

We've been doing a bit of work on tech issues under the GDPR and came across a potential identification issue for apps on both iOS and Android. This could cause regulatory problems under certain conditions.

In short, if your app:
  1. does not strictly require a user logs in to use,
  2. collects pseudonymised "shadow profile" data (e.g. SSAID, analytics, location data), and
  3. operates in a country where similar data protection rights to the (EU's) GDPR exist,
then users could get in touch to exercise their data protection rights (e.g. access, rectification, erasure) and you might not have any technical means to match the user with their data. This is because the user cannot access their SSAID on a per-app basis, and the platform restricts developer access to hardware identifiers.

We wrote this up, with some suggested fixes: https://arxiv.org/pdf/1809.05369.pdf

It's not a very complicated issue to address, and there are lots of ways around it. You could simply expose the SSAID (or whatever identifier you use) in an 'About' section of the app, or use other app functionality (e.g. 'share' URLs) to allow users to provide some kind of hook to their data (though be aware that asking people to sign up for an account or sign into a social media profile to 'link' their shadow account to an identifier they can provide may cause other regulatory issues).

Anyway, just thought it was an interesting problem that may affect some apps out there, so it might be worth thinking about. For example, we see games as particularly vulnerable to this - though they are far from the only apps out there that don't require accounts.

Feel free to get in touch with any questions if you have any.
 
Back
Top Bottom