Most frequently read – Compliance Solutions for Websites, Apps and Organizations | iubenda https://www.iubenda.com/en/ Thu, 05 Feb 2026 12:01:30 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.4 Privacy Policy for Google Ads Remarketing https://www.iubenda.com/en/blog/privacy-policy-for-google-ads-remarketing/ Mon, 23 Sep 2013 19:30:16 +0000 http://www.iubenda.com/blog/?p=1154 This post mainly answers the question how and why you have to include a privacy policy on your website for Google Ads. If you want to read a more general overview of Google services that require a privacy policy, then read here To skip all that and just use our generator to help you make […]

The post Privacy Policy for Google Ads Remarketing appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
This post mainly answers the question how and why you have to include a privacy policy on your website for Google Ads.

Let’s assume you have a website, you run an Google Ads campaign and you are thinking about including a privacy policy. What do you have to do?

1) Do I have to include a privacy policy when I use Google Ads Remarketing?

There are two sides to this question from a legal perspective. But actually only one answer: YES.

  • There is the legal side of it: Depending on where you are you may fall under European, American (Californian) or Australian privacy laws. The list could go on since most countries have some sort of privacy regulations that extend onto the web – and hefty penalties for non-compliance.
  • For remarketing services in general: remarketing services collect some sort of personally identifiable information as a rule of thumb (cookies to identify you and serve the ads based on your browsing history), which is why you have to disclose this fact to people via something like a privacy policy: More information about the legal framework can be found here.
  • There is the company policy side to it as well: Does Google require me in their terms to have a privacy policy when I use their service? See the answer in the next paragraph (II).

2) Am I required by Google to post a privacy policy for Google Ads?

Yes. Google requires users of Google Ads to use a privacy policy. Google requires you to include the following in your privacy policy:

When you use the remarketing or similar audiences feature in your website, you’re required to have the following information in your website’s privacy policy:

  • An appropriate description of how you’re using remarketing or similar audiences to advertise online.
  • A message about how third-party vendors, including Google, show your ads on sites across the Internet.
  • A message about how third-party vendors, including Google, use cookies to serve ads based on someone’s past visits to your website.
  • Information about how your visitors can opt out of Google’s use of cookies by visiting Google’s Ads Settings.
  • Alternatively, you can point your visitors to opt out of a third-party vendor’s use of cookies by visiting the Network Advertising Initiative opt out page.

The most important part in these terms regarding the privacy policy:” (…) you’re required to have the following information in your website’s privacy policy“.

Read more about the Google Ads requirements on the Google Ads support page.

3) How do I add a privacy policy?

Usually, to make a privacy policy legally effective and compliant, it has to be easily found. A best practice is to link to your privacy policy from your footer where your users or visitors can find it at any given time. It should also not be modified to look like you want to hide it (smaller type, light colors that make it literally indistinguishable from the background).

4) An example privacy policy for Google Ads?

A lot of people ask for sample privacy policies for their websites & Google Ads. In reality those samples don’t do anyone much good because they’re far too generic. Let’s start with an enumeration of what needs to go into a privacy policy. Most countries’ privacy laws require you to include the following information:

– What kind of personal data is collected
– Describe how this information will be used by the company.
– Describe how this information will be transferred to third party companies.
– Provide instructions on how users can modify or delete their personal information.
– Provide instructions on how users can opt-out of future communications.
– Identify its effective date and outline how you notify people of material changes to your privacy policy.

Sample wording for Google Ads Remarketing?

As we’ve seen above, depending on the setup of your entire privacy policy – you might want to cram all of the suggestions provided by Google into a Google Ads Remarketing disclosure:

  • You are using remarketing or similar audiences to advertise online.
  • Tell people about how third-party vendors, including Google, show your ads on sites across the Internet.
  • Tell people about how third-party vendors, including Google, use cookies to serve ads based on someone’s past visits to your website.
  • Information about how your visitors can opt out of Google’s use of cookies by visiting Google’s Ads Settings: http://google.com/settings/ads/onweb/optout?hl=en
  • Alternatively, you can point your visitors to opt out of a third-party vendor’s use of cookies by visiting the Network Advertising Initiative opt out page: http://optout.networkadvertising.org/#/


Ideally you would tell the users what the service does in general and how you are using it.

What do I do now?

You can either hire a lawyer, write your own policy or use iubenda’s generator right away to make your policy. The Google Ads clause is a PRO service that you can easily access with a premium account. The Google Analytics clause falls under our free limits.

Our Approach of Generating a Google Ads Privacy Policy

So here’s where iubenda’s privacy policy generator will come in very handy:

  1. Define the services and categories of data collection your site/app is making use of.
  2. Add the services (and categories of data collection like “have a contact form”) you are using to your policy. iubenda now takes care of your policy and generates it for you.
  3. You can either link to your policy or embed the text into your site/app.

Try Our Privacy Policy Generator

Bonus: Google Ads Conversion Tracking

As an additional clause to Google Ads itself you will find a Google Ads conversion tracking clause in your dashboard called “Google Ads Conversion Tracking”.

The post Privacy Policy for Google Ads Remarketing appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Privacy Policy for Google AdSense https://www.iubenda.com/en/blog/privacy-policy-google-adsense/ Mon, 23 Sep 2013 16:30:55 +0000 http://www.iubenda.com/blog/?p=1152 This post mainly answers the question how and why you have to include a privacy policy on your website for Google AdSense. If you want to read a more general overview of Google services that require a privacy policy, then read here To skip all that and just use our generator to help you make […]

The post Privacy Policy for Google AdSense appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
This post mainly answers the question how and why you have to include a privacy policy on your website for Google AdSense.

AdSense Privacy Policy

Let’s assume you have a website, you run a Google AdSense campaign and you are thinking about including a privacy policy. What do you have to do?

IN SHORT

  • Sign up and choose our clause called “Google AdSense”;
  • Then make sure you link to your privacy policy or embed it into your site;
  • Be done and let iubenda do its job;

1) Do I have to include a privacy policy when I use Google AdSense?

There are two sides to this question from a legal perspective. But actually only one answer: YES.

  • There is the legal side of it: Depending on where you are you may fall under European, American (Californian) or Australian privacy laws. The list could go on since most countries have some sort of privacy regulations that extend onto the web – and penalties for non-compliance.
  • For advertisement services in general: advertisement services collect some sort of personally identifiable information as a rule of thumb to make sure they are able to track the effectivity of their ads or to increase their reach and impact, which is why you have to disclose this fact to people via something like a privacy policy: More information about the legal framework can be found here.
  • There is the company policy side to it as well: Does Google require me in their terms to have a privacy policy when I use their service? See the answer in the next paragraph (2).

2) Am I required by Google to post a privacy policy for AdSense?

Yes. Google requires users of Google AdSense to use a privacy policy. When you sign up for Google AdSense, you consent to their terms that state under “8. Privacy”:

You will ensure that at all times you use the Services, the Properties have a clearly labeled and easily accessible privacy policy that provides end users with clear and comprehensive information about cookies, device-specific information, location information and other information stored on, accessed on, or collected from end users’ devices in connection with the Services, including, as applicable, information about end users’ options for cookie management.  You will use commercially reasonable efforts to ensure that an end user gives consent to the storing and accessing of cookies, device-specific information, location information or other information on the end user’s device in connection with the Services where such consent is required by law..

The most important part in these terms regarding the privacy policy: “have a clearly labeled and easily accessible privacy policy that provides end users with (…)“.

3) How do I add a privacy policy for AdSense?

Usually, to make a privacy policy legally effective and compliant, it has to be easily found. A best practice is to link to your privacy policy from your footer where your users or visitors can find it at any given time. It should also not be modified to look like you want to hide it (smaller type, light colors that make it literally indistinguishable from the background).

4) An example privacy policy for Google Analytics?

A lot of people ask for sample privacy policies for their websites & Google AdSense. In reality those samples don’t do anyone much good because they’re far too generic. Let’s start with an enumeration of what needs to go into a privacy policy. Most countries’ privacy laws require you to include the following information:

– What kind of personal data is collected
– Describe how this information will be used by the company.
– Describe how this information will be transferred to third party companies.
– Provide instructions on how users can modify or delete their personal information.
– Provide instructions on how users can opt-out of future communications.
– Identify its effective date and outline how you notify people of material changes to your privacy policy.

Ideally you would tell the users what the service does in general and how you are using it. Note that the above example text is taken out of context. This will not yet be an effective privacy policy on its own.

What do I do now?

You can either hire a lawyer, write your own policy or use iubenda’s generator right away to make your policy. The AdSense clause is a PRO service that you can easily access with a premium account. The Google Analytics clause falls under our free limits.

Our Approach of Generating a Google AdSense Privacy Policy

So here’s where iubenda’s privacy policy generator will come in very handy:

  1. Define the services and categories of data collection your app/site is making use of.
  2. Add the services (and categories of data collection like “have a contact form”) you are using to your policy. iubenda now takes care of your policy and generates it for you.
  3. You can either link to your policy or embed the text into your app/site.

Try Our Privacy Policy Generator

In addition to setting up your privacy policy and depending on your setup, you might need to follow Google’s EU User Consent policy for AdSense. You can find more information about what that means here in this post: About Google’s “EU user consent policy”.

The post Privacy Policy for Google AdSense appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Privacy Policy for Google Analytics https://www.iubenda.com/en/blog/privacy-policy-google-analytics/ Mon, 23 Sep 2013 10:51:39 +0000 http://www.iubenda.com/blog/?p=1137 This post mainly answers the question how and why you have to include a privacy policy on your website for Google Analytics. If you want to read a more general overview of Google services that require a privacy policy, then read here If you want to skip all that and just use our generator to […]

The post Privacy Policy for Google Analytics appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
This post mainly answers the question how and why you have to include a privacy policy on your website for Google Analytics.

Ganalytics_privacy_policy

Let’s assume you have a website, you run Google Analytics on it and you are thinking about including a privacy policy. What do you have to do?

Quick Start Guide for iubenda with Google Analytics

  • Sign up/Sign in and choose our clause called “Google Analytics”;
  • Generate the self-updating privacy policy with a few clicks;
  • Add French, German, Italian, Brazilian Portuguese or Spanish if you need it, it automatically duplicates the clauses from the English version;
  • Add the privacy policy to your site by embedding or linking to it;
  • Do you use Universal Analytics and User ID? See this.

1) Do I have to include a privacy policy when I use Google Analytics?

There are two sides to this question from a legal perspective. But actually only one answer: YES.

  • There is the legal side of it: Depending on where you are you may fall under European, American (Californian) or Australian privacy laws. The list could go on since most countries have some sort of privacy regulations that extend onto the web – and hefty penalties for non-compliance. Check out our Bonus for anonymizeIP
  • For analytics services in general: analytical services collect some sort of personally identifiable information as a rule of thumb, which is why you have to disclose this fact to people via something like a privacy policy: More information about the legal framework can be found here.
  • There is the company policy side to it as well: Does Google require me in their terms to have a privacy policy when I use their service? See the answer in the next paragraph (II).

2) Am I required by Google to post a privacy policy?

Yes. Google requires users of Google Analytics to use a privacy policy. When you sign up for Google Analytics, you consent to their terms that state under “7. Privacy”:

You will not (and will not allow any third party to) use the Service to track, collect or upload any data that personally identifies an individual (such as a name, email address or billing information), or other data which can be reasonably linked to such information by Google. You will have and abide by an appropriate Privacy Policy and will comply with all applicable laws and regulations relating to the collection of information from Visitors. You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies that are used to collect traffic data, and You must not circumvent any privacy features (e.g., an opt-out) that are part of the Service.

And…

You may participate in an integrated version of Google Analytics and any DoubleClick product or service or any other Google display ads product or service (“Google Analytics for Display Advertisers”). If You use Google Analytics for Display Advertisers, You will comply with the Google Analytics for Display Advertisers Policy (available at http://support.google.com/analytics/bin/answer.py?hl=en&topic=2611283&answer=2700409 ) and, as set forth in the policy, disclose in Your Privacy Policy (i) Your use of Google Analytics for Display Advertisers and its features You use, and (ii) how Visitors can opt-out from Google Analytics for Display Advertisers. Your access to and use of any DoubleClick or Google display ads data is subject to the applicable terms between You and Google.

The most important part in these terms regarding the privacy policy:” You will have and abide by an appropriate Privacy Policy (…)“.

3) How do I add a privacy policy?

Usually, to make a privacy policy legally effective and compliant, it has to be easily found. A best practice is to link to your privacy policy from your footer where your users or visitors can find it at any given time. It should also not be modified to look like you want to hide it (smaller type, light colors that make it literally indistinguishable from the background).

4) An example privacy policy for Google Analytics?

A lot of people ask for sample privacy policies for their websites & Google Analytics. In reality those samples don’t do anyone much good because they’re far too generic. Let’s start with an enumeration of what needs to go into a privacy policy. Most countries’ privacy laws require you to include the following information:

– What kind of personal data is collected
– Describe how this information will be used by the company.
– Describe how this information will be transferred to third party companies.
– Provide instructions on how users can modify or delete their personal information.
– Provide instructions on how users can opt-out of future communications.
– Identify its effective date and outline how you notify people of material changes to your privacy policy.

Ideally you would tell the users what the service does in general and how you are using it.

What do I do now?

You can either hire a lawyer, write your own policy or use iubenda’s generator right away to make your policy. The Google Analytics clause falls under our free limits.

Our Approach of Generating a Google Analytics Privacy Policy

So here’s where iubenda’s privacy policy generator will come in very handy:

  1. Define the services and categories of data collection your app/site is making use of.
  2. Add the services (and categories of data collection like “have a contact form”) you are using to your policy. iubenda now takes care of your policy and generates it for you.
  3. You can either link to your policy or embed the text into your app/site.

Generate a privacy policy for Google Analytics

 

Bonus 1: Display Advertising for Google Analytics

It’s possible to update your Google Analytics implementation with a snippet to support Display Advertising. This snippet makes use of the DoubleClick cookie and will additionally allow you to track things like

This takes slight modifications/additions to your privacy policy which is outlined in our post privacy policy for Display Advertising for Google Analytics.

Bonus 2: Lawful use of Google Analytics in Germany

To ensure compliance in Germany, the German DPA of Hamburg has released guidelines for helping website operators with Google Analytics and privacy law compliance. Therefore you have to:

Generate a Privacy Policy in German and read our guide

The post Privacy Policy for Google Analytics appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Privacy Policy for iOS Apps https://www.iubenda.com/en/blog/privacy-policy-for-ios-apps/ Fri, 14 Jun 2013 10:04:06 +0000 http://www.iubenda.com/blog/?p=635 Welcome. This post answers the question how and why you should add a privacy policy to your iOS app. If you want to read a more general overview of privacy policies in mobile apps then you can read that here You can skip all that and just use our generator to help you make a […]

The post Privacy Policy for iOS Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Welcome. This post answers the question how and why you should add a privacy policy to your iOS app.

privacy policy for iOS Apps and the App Store

Let’s say you want to include a privacy policy into your iOS application: what do you need to do?

In Short

1) Do I have to include a privacy policy in my iOS app?

  1. Well, that depends on what the app is doing. But consider the fact, that you can never be wrong including a link or a full page view of your privacy policy. It is however very likely that you are required by law to include a privacy policy into your iOS application. Easy CHECK: Am I collecting/storing/sharing personal information like email, names or sensitive data like payments info or using a third party service that accesses my info?
  2. You are likely using a third party service in your app that requires you to add a privacy policy to your app. Additionally to a legal requirement it is often an additional prerequisite to use a specific service. Check in your service provider’s terms. A very popular third party service that requires you to post a privacy policy in their TOS is Google Analytics (they also have a mobile solution).

2) Am I required by Apple’s App Store to post a privacy policy?

iTunes Connect privacy policy requirements 

You could post an app to the store that is non-compliant with privacy laws. However since WWDC 16, there has been a lot of change and general consolidation in Apple’s App Store Review Guidelines. You can now find all the relevant information regarding privacy policies in section 5.1. It will tell you when you are indeed required to add a privacy policy:

  • (i) Apps that collect user data must have a privacy policy and secure user consent for the collection. This includes—but isn’t limited to—apps that implement HealthKit or other health/medical technologies, HomeKit, Keyboard extensions, Apple Pay, include a login, or access user data from the device (e.g. location, contacts, calendar, etc.). – (from 5.1.1)
  • iOS 11 adds new requirements “apps that utilize ARKit, Camera APIs, Photo APIs, or other software for depth of facial mapping information,” to the list of apps that are required to offer a privacy policy.
  • Moreover, apps in the Kids Category or those that collect, transmit, or have the capability to share personal information (e.g. name, address, email, location, photos, videos, drawings, the ability to chat, other personal data, or persistent identifiers used in combination with any of the above) from a minor must include a privacy policy and must comply with all applicable children’s privacy statutes. For the sake of clarity, the parental gate requirement for the Kid’s Category is generally not the same as securing parental consent to collect personal data under these privacy statutes. – (from 5.1.4)

Now, Apple got very good at making these rules very clear.

3) How do I add/edit my privacy policy on the App Store?

privacy policy iTunes Connect

This section is for the link to your privacy policy on the App Store and not in the actual app. There is a link form for privacy policy URLs when you submit your app for review. Fill that in.

In iTunes Connect, under “My Apps”, you will find “Localisable Information”, among which you will also find the privacy policy URL. Fill in a privacy policy for each language that your app is translated into (iubenda offers 8 privacy policy languages out of the box at the moment)

When you visit the app page that the store generates for you, e.g.

https://itunes.apple.com/app/idxXxxXXXetc,

you will not find that privacy policy link (yet). This is only the case however, because Apple decided not to show it there yet, for some reason. You will find the link when opening the app in an iTunes window:

app_store_privacy_policy_link

4) An example privacy policy for iOS apps?

A lot of people ask for sample privacy policies for apps. Let’s start with the legal minimum requirements. A good starting point is the California Online Privacy Protection act (CalOPPA), and even better Europe’s minimum requirements since they are more refined:

CalOPPA minimum requirements:

Provide info about the personally identifiable information (PII) like:

  • a description of the types of PII collected and disclosed by the operator;
  • a description of the process by which a consumer can access and request changes to his or her PII, if available;
  • a description of the process by which the operator will notify consumers of material changes to the privacy policy; and
  • an effective date

EU Privacy Directives minimum requirements:

Provide a readable, understandable and easily accessible privacy policy, which at a minimum informs users about:

  • who you are (identity and contact details),
  • what precise categories of personal data the app wants to collect and process,
  • why the data processing is necessary (for what precise purposes),
  • whether data will be disclosed to third parties (not just a generic but a specific
    description to whom the data will be disclosed),
  • what rights users have, in terms of withdrawal of consent and deletion of data

Here are some helpful docs by authorities about privacy policies.

Helpful docs:

  1. Privacy on the Go
  2. Article 29 Working Group

Our Approach of Generating an iOS Privacy Policy

So here’s where iubenda’s privacy policy generator will come in very handy:

1) Define the services and categories of data collection your app is making use of.

2) Add the services (and categories of data collection like “access to address book”) you are using to your policy and it will generate the full text privacy policy in a condensed easily scannable fashion as well as an entire document your users can read if they want.

3) You can either link to your policy or embed the text into your app.

4) Any additional texts can be added by you manually.

5) Add many other languages for localised versions of your app.

6) Modify and change your privacy policy at any time

Generate your iOS Privacy Policy now

Since we’ve launched our mobile apps privacy policy generator we’ve started to publish guides on how to submit your app to the app stores with a privacy policy. You are reading the guide on the App Store by Apple. 

All our other guides can be found here:

Read this guide also in German “Datenschutzerklärung für iOS Apps

The post Privacy Policy for iOS Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Privacy Policy for Android Apps https://www.iubenda.com/en/blog/privacy-policy-for-android-app/ Thu, 13 Jun 2013 14:42:59 +0000 http://www.iubenda.com/blog/?p=605 This post answers the important question how and why you must add a privacy policy to your Android app. What do you need to do and be aware of if you want to include a privacy policy into your Android application? Contents Do you really need a privacy policy? What does Google and the Play Store say? How do […]

The post Privacy Policy for Android Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
This post answers the important question how and why you must add a privacy policy to your Android app.

Android apps privacy policy

What do you need to do and be aware of if you want to include a privacy policy into your Android application?

Let us go through this systematically. Feel free to skip a section you might already know enough about.

1) Do I have to include a privacy policy in my Android app?

That depends on what your app is doing. Consider that you are always on the safer side including a link or a full page view of your privacy policy.

It is very likely that you are required by law to include a privacy policy into your Android app.

Easy check: Am I collecting/storing/sharing personal information like email, names or sensitive data such as payments information or am I using a third party service that accesses that information?

You are likely using a third party service in your app that requires you to add a privacy policy. In addition to any legal requirements, third parties often require a privacy policy as an additional prerequisite to use a specific service. Check in your service provider’s terms. A very popular third party service that requires you to post a privacy policy in their TOS is Google Analytics (they also have a mobile solution).

2) Am I required by the Google Play Store to post a privacy policy?

You may get away with not posting a privacy policy, but don’t be deceived, this doesn’t mean it’s not required in your situation. If you use dangerous permissions like the camera, contacts, audio, accounts and phone state you will get mail by Google. Count on it. 

Since February 2017 Google enforces a strict privacy policy requirement on apps requesting sensitive permissions and user data. There are quite a few places in the Google Play Store documentation that points out that requirement.

If you want to read up the statements by Google in their documentation and terms, you can find them below following the links or by reading the excerpts shown.

From the Developer Console Help: 

Adding a privacy policy to your app’s store listing helps provide transparency about how you treat sensitive user and device data.

The privacy policy must, together with any in-app disclosures, comprehensively disclose how your app collects, uses and shares user data, including the types of parties with whom it’s shared. Google is unable to provide you with legal advice and you should consult your own legal representative.

  • For apps that request access to sensitive permissions or data (as defined in the user data policies): You must link to a privacy policy on your app’s store listing page and within your app. Make sure your privacy policy is available on an active URL, applies to your app, and specifically covers user privacy.
  • For apps in the Designed for Families program: You must link to a privacy policy on your app’s store listing page and within your app, regardless of your app’s access to sensitive permissions or data. Make sure your privacy policy is available on an active URL, applies to your app, and specifically covers user privacy.
  • For other apps: You’re not required to post a privacy policy.

In other words, it is very unlikely that you are not covered by any of the requirements set out either by the Platform (Play Store), third party service providers or any of the privacy regulations. How do you add and edit that privacy policy on the Play Store?

3) How do I add/edit my privacy policy on the Play store? (source)

  1. Log into your Google Play Developer Console
  2. Next, select All Applications and select the application whose privacy policy you’d like to edit.
  3. After that, select Store Listing.
  4. Then, scroll to the section marked Privacy Policy and enter the URL where you have the privacy policy hosted online – generate your privacy policy here.
  5. Lastly, be sure to click Save or update.

4) What if I don’t want to add a privacy policy at this time?

If you do not want to add a privacy policy at the moment very first moment you create the app, you can check the box next to Not submitting a privacy policy URL at this time (see screenshot above) on the Store Listings screen of your application in the Google Play Developer Console. Follow the instructions above to view that screen.

5) What if I’m using sensitive/dangerous Android permissions?

Google has started to enforce proper privacy policy disclosures for sensitive permissions in apps (or also if your app makes use of any user data at all, for instance using Admob). A good example of a data type are location permissions that allow accessing the device location such as follows:

Design pattern supplied by the Permissions Pattern Library

You might be using other dangerous/sensitive permissions like access to the camera, contacts, audio, accounts and phone state. In this case you are required to have your privacy policy in place properly and also incorporate text disclosing your use of these permissions.

If any of the following permissions look familiar to you, check out the guide for incorporating these permissions into your privacy policy:

  • READ_CALENDAR
  • WRITE_CALENDAR
  • CAMERA
  • READ_CONTACTS
  • WRITE_CONTACTS
  • GET_ACCOUNTS
  • ACCESS_FINE_LOCATION
  • ACCESS_COARSE_LOCATION
  • RECORD_AUDIO
  • READ_PHONE_STATE
  • CALL_PHONE
  • READ_CALL_LOG
  • WRITE_CALL_LOG
  • ADD_VOICEMAIL
  • USE_SIP
  • PROCESS_OUTGOING_CALLS
  • BODY_SENSORS
  • SEND_SMS
  • RECEIVE_SMS
  • READ_SMS
  • RECEIVE_WAP_PUSH
  • RECEIVE_MMS
  • READ_EXTERNAL_STORAGE
  • WRITE_EXTERNAL_STORAGE

Of course, do not forget that these sensitive permissions aren’t the only trigger for a privacy policy requirement.

6) About Prominent Disclosure requirements

This part in Google’s User Data policy is key: “If your app collects and transmits personal or sensitive user data unrelated to functionality described prominently in the app’s listing on Google Play or in the app interface, then prior to the collection and transmission, it must prominently highlight how the user data will be used and have the user provide affirmative consent for such use.

If you collect and transmit personal or sensitive user data unrelated to functionality described prominently in the app’s listing on Google Play or in the app interface with your app, then you need add prominent disclosures. You can read more about prominent disclosures it here.

7) An example privacy policy for Android Apps?

A lot of people ask for sample privacy policies for apps. Let’s start with the legal minimum requirements. A good starting point is the California Online Privacy Protection act (CalOPPA), and even better Europe’s minimum requirements since they are more refined:

CalOPPA minimum requirements:

Provide info about the personally identifiable information (PII) like:

  • a description of the types of PII collected and disclosed by the operator;
  • a description of the process by which a consumer can access and request changes to his or her PII, if available;
  • a description of the process by which the operator will notify consumers of material changes to the privacy policy; and
  • an effective date

EU Privacy Directives minimum requirements:

Provide a readable, understandable and easily accessible privacy policy, which at a minimum informs users about:

  • who you are (identity and contact details),
  • what precise categories of personal data the app wants to collect and process,
  • why the data processing is necessary (for what precise purposes),
  • whether data will be disclosed to third parties (not just a generic but a specific
    description to whom the data will be disclosed),
  • what rights users have, in terms of withdrawal of consent and deletion of data

8) How to actually write a privacy policy for your Android Google Play app

Since iubenda and mobile apps are international practically by definition, let us take some hints from two relevant diverse entities far apart from each other:

Privacy on the Go” by the Attorney General of California and the “Orientierungshilfe zu den Datenschutzanforderungen an App-Entwickler und App-Anbieter” the document produced by the German data protection agencies (which we’ll summarize in English).

From Privacy on the Go:

  • “Make the privacy policy clear and understandable by using plain language and a format that is readable on a mobile device”
  • “One format is a layered notice that highlights the most relevant privacy issues.”
  • “Another format is a grid or “nutrition label for privacy” that displays your privacy practices by data type.”
  • “Graphics or icons can help users to easily recognize privacy practices and settings.”
  • “Privacy icons will be most effective if they are widely used and consumer comprehension is supported by an awareness campaign.”

The most important takeaway is, that it is ok, even encouraged, to be creative. Don’t forget to back the creativity up with the actual readable full version of your policy.

From Orientierungshilfe zu den Datenschutzanforderungen an App-Entwickler und App-Anbieter:

“Wegen der beschränkten Display-Größe mobiler Endgeräte sind die Datenschutzhinweise vom App Anbieter derart zu gestalten, dass der Nutzer jederzeit ohne großen Aufwand die gewünschten Informationen erhalten kann. Als besonders benutzerfreundlich hat sich dabei die Einteilung in Kapitel, welche einzeln geöffnet werden können, herausgestellt. Darüber hinaus kann es auch genügen, die wesentlichen Inhalte der Datenschutzerklärung wiederzugeben und für darüber hinausgehende Informationen gut sichtbar auf weitere Erläuterungen sowie die vollständige Datenschutzerklärung zu verlinken. Was die wesentlichen Inhalte der Datenschutzerklärung sind, bestimmt sich anhand des Funktionsumfangs der App.”

In the section Lesbarkeit (readability), the data protection authorities outline that, because of the small screen real-estate, it is particularly useful to create small “categories that can be opened one by one”.

The most important takeaway here is, that a layered approach is state of the art and explicitly welcomed by the data protection authorities for mobile apps.

We think these are very solid guidelines to be creative within. Let us show you what we did with it at iubenda for mobile apps:

 

9) iubenda’s Approach of Generating an Android Privacy Policy

This post gives you all the information for getting started to write your privacy policy. Here’s where iubenda’s privacy policy generator will come in very handy:

In Short

Generate your Android Privacy Policy Now


Since we’ve launched our mobile apps privacy policy generator we’ve started to publish guides on how to submit your app to the app stores with a privacy policy. You are reading the guide on the Android Play Store by Google. 

All our (other) guides can be found here:

Other related interesting reading: 

 

Read this guide also in German “Datenschutzerklärung für Android Apps

The post Privacy Policy for Android Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>