Identity of the controller. Purposes. Legal basis. Recipients. Retention period. Data subject rights. Every data protection practicioner can recite the Article 13 checklist in their sleep. Tick every box, and the privacy policy is done.
Or is it? If your company develops apps, browser extensions, video games or similar products, the policy has to get past another reader before it reaches a single user: the platform reviewer. And many privacy professionals have not considered how a perfectly compliant privacy policy can prove deficient in real-life use.
Many Rulebooks, One Policy
When drafting a privacy policy, data protection professionals usually start with the applicable legal framework. For a company subject to the GDPR, this means identifying the information that must be provided under Articles 13 and 14. If the company has a presence in other jurisdictions, professionals specialised in multi-jurisdictional work, such as FIRST PRIVACY consultants, can craft texts that survive scrutiny from different regulators.
However, the applicable legal frameworks are not the only thing to consider when a product is distributed through a third-party platform. Apple’s App Store, Google Play and the Chrome Web Store, to name the biggest examples, each have their own disclosure requirements and review processes on privacy and data handling. These rules are not law, but they can make the difference between your product seeing the light of day and staying in beta forever.
Where the Differences Lie
Platform requirements overlap with data protection law a lot, but not completely. Let us explore some of the differences that we have found interesting in practice. This is not an exhaustive list:
- They care about “data”, not necessarily “personal data”. Most app stores require a privacy policy for all apps, regardless of whether personal data is involved at all. This means that you may still need to disclose details about data that is usually off the radar, such as anonymised data.
- Even data that never leaves the device. You will probably have to disclose how the app handles data even when the data is processed or stored only on the user’s device and never reaches the developer’s servers. Under the GDPR, whether a developer is a controller for processing that happens entirely on someone else’s device is a question on which reasonable lawyers can disagree. The Chrome Web Store simply settles it in favour of disclosure.
What does a privacy policy for no personal data look like? Mostly a short explanation of what is not happening: “This extension does not transmit your browsing data anywhere” is the kind of statement reviewers are expecting.
- Security, described. Google Play expects the privacy policy to describe the developer’s secure data handling procedures. The GDPR requires appropriate security under Article 32, but it does not require a description of it in the privacy policy.
- Names, not categories. The platforms tend to require the policy to disclose all parties the data will be shared with. Article 13 para. 1 lit. e of the GDPR, in contrast, is more lenient and lets the controller either name the recipients of personal data or describe their categories. (That said European regulators are leaning towards names.)
It Works Both Ways
None of this means that platform approval equals legal compliance. The GDPR (and equivalent laws around the world) contains many requirements that the platforms do not ask for. Therefore, a green light from App Store review says nothing about how a data protection authority would view the same policy.
Overreach or Fair Game?
Are the platforms overstepping? We don’t think so.
Platforms can have good reasons to set requirements that serve purposes beyond the protection of personal data. Besides their own legal obligations, they weigh risk management, product design, business policy, contractual choices and, increasingly, public opinion. A platform that markets itself on privacy has every interest in making its developers live up to high standards.
And their rules are, of course, subject to applicable law: they cannot contradict it, only supplement it.
How to Proceed in Practice
The biggest tip we can provide is to know your audience. A privacy policy for an app, game or extension has at least three readers: the user, the supervisory authority and the platform reviewer. Each looks for something different. In practice, this means:
- Start with the law. The applicable privacy laws remain the foundation, and no platform checklist replaces them.
- Map the distribution channels. If the product is going into a store, read that store’s requirements before the policy is finalised.
- Keep label, policy and product aligned. The store label, the privacy policy and the product’s actual behaviour must tell the same story.
A privacy policy should be legally compliant. But the compliance exercise should not end with the law.
No comments