ePrivacy Directive Compliance for Mobile Apps

Many mobile developers face app rejection due to missing tracking request or incorrect consent UI. Apple is particularly strict after introducing ATT in iOS. We help avoid such issues by bringing your app into compliance with the ePrivacy Directive (2002/58/EC). For mobile apps, it is significantly stricter than for websites, as it covers not only cookies but any trackers, SDKs, and advertising IDs considered equivalent to cookies. According to our statistics, about 70% of projects fail initial audit in the consent area — from incorrect request timing to missing IAB TCF strings. Fixing consent does not require a complete rebuild: 2-3 weeks for integration and testing is enough.

How ePrivacy Differs from GDPR for Mobile

GDPR regulates processing of personal data. ePrivacy regulates access to the device and storage of information on it. These are different legal bases. The advertising identifier IDFA or GAID — storage on the device requires consent under ePrivacy, regardless of whether it's personal data under GDPR. That's why Apple introduced ATT: they effectively implemented ePrivacy at the system level. Fingerprinting (collecting device characteristics for identification without cookies) also falls under ePrivacy. If an SDK collects screen resolution + OS version + device model + timezone and hashes them into an identifier, it's essentially the same as a cookie, only without the ability to delete.

Which Data Requires Consent Under ePrivacy?

Consent is not needed for:

• Technically necessary operations: session token storage, shopping cart, user settings.
• Security: fraud detection, DDoS protection.
• Analytics in aggregated form without cross-device tracking (disputed among regulators, but in 80% of cases auditors require consent).

Consent is needed for:

• Advertising ID / IDFA for any purpose except attributing install.
• Behavioral advertising.
• Cross-app or cross-site tracking.
• Fingerprinting.
• Push notifications if they are marketing, not functional (transactional).

How to Implement ATT Correctly

AppTrackingTransparency.framework is mandatory for any iOS app using IDFA or cross-app tracking. Step-by-step:

1. Add NSUserTrackingUsageDescription to Info.plist with a description of why tracking is needed.
2. Import AppTrackingTransparency in your code.
3. Call ATTrackingManager.requestTrackingAuthorization at the right moment — after onboarding, when the user already understands the app's value.
4. Handle statuses: .authorized — you can read IDFA; .denied, .restricted — cannot; .notDetermined — request again later.

import AppTrackingTransparency func requestTrackingPermission() { ATTrackingManager.requestTrackingAuthorization { status in switch status { case .authorized: // Can read IDFA let idfa = ASIdentifierManager.shared().advertisingIdentifier self.initializeMarketingSDKs(with: idfa) case .denied, .restricted: // Cannot use IDFA, cannot pass to ad networks self.initializeMarketingSDKsWithoutIDFA() case .notDetermined: break } } } 

Apple may reject the app if the request appears too early. On Android there is no similar system dialog, so consent is managed via a custom consent UI plus IAB TCF/GPP strings. Comparison: on iOS the process is mandatory and takes about 2 days; on Android up to 5 days due to custom UI.

Why Consent Is Needed Even for Analytics

Many developers assume aggregated analytics doesn't require consent. However, regulators often interpret otherwise. For example, if an analytics SDK (Firebase, Amplitude) sends device model + OS version + app version with a unique installation identifier, it becomes potential tracking. In practice, 90% of SDKs used in mobile apps request advertising identifiers or transmit data that could be used for identification. Better to err on the side of caution and request consent for any third-party SDK except those technically necessary.

Consent Management for ePrivacy

IAB Europe developed the Transparency and Consent Framework (TCF v2.2) for mobile apps. Implementation via an IAB-certified Consent Management Platform (CMP):

// Reading TCF consent string from SharedPreferences (IAB standard) val consentString = sharedPrefs.getString("IABTCF_TCString", null) val purposeConsents = sharedPrefs.getString("IABTCF_PurposeConsents", null) // "1" at position N = consent granted for purpose N // Purpose 1 — basic advertising val adStorageConsent = purposeConsents?.getOrNull(0) == '1' // Purpose 3 — personalized profile val personalizationConsent = purposeConsents?.getOrNull(2) == '1' 

Standard IABTCF_* keys are automatically read by all compatible SDKs — AdMob, Criteo, The Trade Desk, and other IAB-compliant partners.

What Is Included in the ePrivacy Compliance Work

We provide a comprehensive audit and implementation:

• Check all SDKs for ePrivacy compliance (analytics, advertising, crash reporting).
• Integrate ATT on iOS with correct timing.
• Develop or integrate a CMP (Google User Messaging Platform, OneTrust, Quantcast).
• Configure IAB TCF v2.2 strings and pass them to SDKs.
• Test on real devices and via TestFlight.
• Prepare documentation for App Store Review and Google Play Console.
• Train your team on consent management.

We have 5+ years of experience in mobile development; over 40 projects passed audit and meet regulatory requirements. Contact us to get a consultation — we will assess your app in 2-3 days and propose a work plan. Reach out to guarantee passing App Store and Google Play reviews. We will conduct a full audit of your app — from consent to SDK configuration.