back to article App devs bewildered by last-minute Google GDPR klaxon

Android developers are scrambling to change their apps after 11th hour privacy instructions from Google left them waiting on an SDK which still isn't ready. On 4 May, just three weeks before the deadline for implementing GDPR, Google emailed developers who use its Admob advertising system that a new consent API was being …

  1. Anonymous Coward
    FAIL

    Sorry Google, you've fucked up again.

    "At first Google said that if the user doesn't provide the consent, "you should close the app, and again show the consent dialog on the next app launch..."

    Had the kids in Google actually read GDPR at this point?

    "Avoid making consent to processing a precondition of a service."

    https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/

    1. lowwall

      Re: Sorry Google, you've fucked up again.

      Looks like they've already addressed that:

      Google returned to the fray. There will be three options on the consent dialog, a rep explained: 1) Personalised ads 2) Non-personalised ads or 3) Ad free.

      "The first two constitute consent to show ads to the user (personalized or non-personalized as the case may be)," explained Google's "Sam".

      "The third option is up to you. As previously mentioned, a common use case will be to send the user to the store listing for the premium version of your app."

      This makes perfect sense to me. Instead of having to dig through settings menus to turn off ad tracking, you get the option at first run. And, depending on what the app maker decides to offer, you may have a further ad-free paid version. They should, however, list the price of the ad-free version on the consent dialog so the choice is clear.

      1. Mage Silver badge
        Devil

        Re: list the price of the ad-free version on the consent dialog

        Before you waste time and bandwidth downloading it!

        Most apps with adverts have no adfree version at any price, or at a sensible price. Also how do you get the money back if the paid version is rubbish?

        I'm not going to consent to adverts to test an app.

        1. matjaggard

          Re: list the price of the ad-free version on the consent dialog

          Why not? Do you really never use ad supported apps at all?

          1. JohnFen

            Re: list the price of the ad-free version on the consent dialog

            I certainly don't.

          2. eldakka

            Re: list the price of the ad-free version on the consent dialog

            > Why not? Do you really never use ad supported apps at all?

            I use a few, but not many. It's a good way to build up a blacklist, get add, put advertiser on blacklist and never interact or purchase from that advertiser.

          3. katrinab Silver badge

            Re: list the price of the ad-free version on the consent dialog

            No, unless advertising is the purpose of the app and I install it because I want to see those ads; eg Vouchercloud.

  2. israel_hands

    If the instructions being reported in the article are an accurate reflection of Google's advice then they've already fucked their GDPR compliance.

    One of the tenets is that a user refusing consent is not grounds for refusing access to the service unless the consent is required for the service to function.

    This means closing the app and asking for permission again the next time the app is opened (and then closing it again until acceptance is given) is in violation.

    EDIT: Beaten to it by someone who even linked the relevant ruling.

    1. Killfalcon Silver badge

      Query - does "paying the bills" count as "essential" to the service functioning?

      That's a serious question. If the answer is yes then a lot of oher problems emerge - like claiming that "selling data to third parties" is too lucrative to not due, and without it the service wouldn't exist, so it's essential, etc, which is a painful argument to even type and will probably fail hard when it hits the regulators.

      If the answer is no, then I imagine apps will swing back to paid-by-default (instead of free-with-ads), or slip further into microtransactional hell. I mean, my preference is always "let me just give you money instead of you giving me ads", but the devs gotta pay the rent *somehow*.

      I expect that if everyone in the EU is allowed to use ad-funded apps ad-free, then ad-funded apps will probably stop being available at all in short order.

      1. Anonymous Coward
        Anonymous Coward

        I expect that if everyone in the EU is allowed to use ad-funded apps ad-free, then ad-funded apps will probably stop being available at all in short order.

        And what's the problem with that? People might have to choose between paying, or not having the product, which doesn't seem unreasonable.

    2. John Brown (no body) Silver badge

      "If the instructions being reported in the article are an accurate reflection of Google's advice then they've already fucked their GDPR compliance."

      If you mean Google, then no because you can still access the Google Play Store and there are ad-free apps there as well as pay to play apps.

      If you mean the app providers, then the clarification seems to work, ie consent to targeted ads, consent to generic ads or buy an ad-free version. Those who, dom't, won't or can't provide am ad-free version may have issues, but even that's not a given since there are very few, if any, unique apps giving the user the choice that way.

  3. Zog_but_not_the_first
    IT Angle

    Can't...

    ... they just assume consent and carry on slurping? They're Google, after all.

    Not evil, or anything like that.

    Maybe.

  4. Cuddles

    "Also who is going to consent to personalised ads above non-personalised ads, given the choice?"

    Good question. Perhaps instead of complaining that this means Google are doing something wrong, you should start asking yourself some serious questions about why you want to force something on your customers that none of them would consent to if given a choice.

    1. Pascal

      Technically, because if your app is free and ad-driven, they're not your customers, they're your product. Hasn't that been the generally accepted consensus for a while already?

      Anyway I hate ads as much as the next guy and would rather pay for an app than have ads, I think it's the most annoying shit that can ever be put in a mobile app.

      But it seems Google also fucked up in the sense that GDPR doesn't require consent to show ads, it would only requires consent to track users (so personalised ads)? Shouldn't their API be about consenting for personalized ads (with tracking) vs generic ads, without forcing the "no ads" option?

      1. Anonymous Coward
        Anonymous Coward

        "ads (with tracking) vs generic ads"

        As long as the generic ads don't track too collecting personal data, because you need consent in such case.

        The problem with ads it's not the way they are selected, it's what you send them to select one, or what they do when displayed even when selected randomly.

      2. JohnFen

        "But it seems Google also fucked up in the sense that GDPR doesn't require consent to show ads, it would only requires consent to track users (so personalised ads)? "

        This.

        The ad industry conflates advertising with tracking so much that I suspect it's an intentional thing -- talk about ads rather than tracking, so that we can offer paid ad-free versions that still include all the tracking.

    2. Anonymous Coward
      Anonymous Coward

      you should start asking yourself some serious questions about why you want to force something on your customers that none of them would consent to if given a choice

      But they DO have a choice. Take the app and the privacy hit, or do without the app and the privacy hit. Tesco, British Gas, Volkswagen all force a bill on customers who want a product. Given a choice of paying, or not paying and suffering no short term consequences, I suspect many would opt to avoid paying.

      You'll want to respond that in extremis there would be no products supplied, but there's all manner of T&Cs that suppliers force onto customers that (given a choice without consequences) the customers wouldn't choose.

  5. Rich 2 Silver badge

    Oh how funny is this?

    Mmmm... let me see, as I fire up my fave phone app.

    Oh. It's asking me if I fancy being tracked?

    Errrrr... I think not.

    When will the ad pushers get it that what they are pushing nobody actually wants? Especially, WHY would I want ads personalised for me? To "improve" my experience? No thanks

    1. matjaggard

      Re: Oh how funny is this?

      Why not? Unpersonalised ads are just annoying, personalised ones are useful in maybe 0.1% of cases.

  6. John70

    App developers also need to re-examine their own apps on what permissions it needs to function properly and what data it's slurping up.

    For example a torch app does not need access to the contacts list, Internet, SMS, etc...

    1. Anonymous Coward
      Joke

      "a torch app does not need access to the contacts list, Internet, SMS"

      Hey, how can you read them in the dark???

  7. Dan 55 Silver badge
    Mushroom

    Do not attempt to use these APIs before May 25, because they may disrupt ad serving on your app

    "I don't always test my code, but when I do I do it in production."

  8. 0laf

    Do you really think Google cares?

    They know they've enough money to keep any challenge in the courts for decades.

    1. JimmyPage Silver badge
      Stop

      re: Do you really think Google cares?

      In this case, yes.

      Unlike the tissue-paper approach to protecting personal data the UK has got away with for decades, GDPR has a fucking big sting behind it, predicated on a transgressors *global* turnover. Which, in Googles case, is billions of dollars.

      And I can't see anyone cutting Google any slack, when they've had so long, and access to so many resources to address the issue.

      1. John Brown (no body) Silver badge

        Re: re: Do you really think Google cares?

        "GDPR has a fucking big sting behind it, predicated on a transgressors *global* turnover. Which, in Googles case, is billions of dollars."

        Unless we suddenly discover that Google.eu is a separate entity from Global Google and/or Alphabet and they don't actually have any turnover because that's all handled by another separate entity outside of the EU. Avoiding GDPR will become as a big a sport as avoiding taxes.

        1. Oengus

          Re: re: Do you really think Google cares?

          that's all handled by another separate entity outside of the EU

          The best part of the GDPR is you don't have to be a European company for the rules to apply. If you process or control the data of European citizens you are responsible for the compliance. If "Google.eu" exists they will have turnover (maybe not profits) because someone has to collect payment for the advertising they are providing...

          1. Dan 55 Silver badge

            Re: re: Do you really think Google cares?

            Doesn't matter, the data is processed by Google.com.

    2. Eddy Ito

      Yes, I think Google cares very deeply, for their revenue and perhaps their stock price. Yes, that's it, I think that's a fairly exhaustive list.

  9. Anonymous Coward
    Anonymous Coward

    What about withdrawing consent

    That should be easy too, but just asking on first use doesn't make future withdrawal od consent easy / straight forward.

    Even if you choose generic ads, Google still apply a unique advertising ID to your device which they track. I think that by applying a unique ID that data then becomes defacto personal, ie it's unique to me, it will be interesting what the regulator says about that in 15 days.

    1. JohnFen

      Re: What about withdrawing consent

      Yes, according to all common sense "advertising IDs" are very much PII.

  10. Mage Silver badge

    generic ads, Google apply a unique advertising ID

    That absolutely needs to stop. Unless they want to kill advert funded apps.

  11. JohnFen

    Great user experience?

    ""That doesn't sound like a great user experience to me," one developer told us. "Also who is going to consent to personalised ads above non-personalised ads, given the choice?""

    I'm sorry, anonymous developer, but once you've decided to hook your app into an ad ecosystem, you given up any right to be taken seriously when talking about "great user experiences".

    1. Brewster's Angle Grinder Silver badge

      Market contraction incoming

      You can't blame individual app developers for what's a broad cultural choice made by users. Nobody wants to ruin their app with ads. But non-technical (Android) users have been unwilling to pay and very willing to give away their privacy.

      Maybe all Android devs unanimously saying "you've got to pay" will force user to start paying. Or maybe people will manage with less and devs will go out of business.

      1. JohnFen

        Re: Market contraction incoming

        "You can't blame individual app developers for what's a broad cultural choice made by users. Nobody wants to ruin their app with ads."

        I disagree. App developers drove this "broad cultural choice" to begin with, and it seems a bit disingenuous to claim innocence now. I remember when developers started going down this road. It wasn't because that's what people were demanding, it's because developers were choosing the path of least resistance. It's a lot easier to hook into an ad ecosystem than to handle being paid by people buying your software.

        Besides, there are lots of applications that charge money and do very well, so I seriously suspect the argument that "nobody wants to pay" is exaggerated to a fairly ridiculous degree.

        1. JonDoe99

          Re: Market contraction incoming

          As an app-developer myself, I can tell you that it's very hard to persuade Android users to part with any money at all. I have an app near the top of its category, currently available as a free, feature-limited version (without ads), with a full-featured version selling for a few dollars (after sales tax, Play Store fees, and income tax, I'm lucky if I see a third of that). My app has a fairly typical 1-2% conversion rate from free to paid version, so I would need millions of downloads a year just for a very basic wage. Frankly, I'm left with no choice but to introduce ads. The only other option is a bit too morally-dubious for me to stomach - preying on the rare addicts who you can bleed to death with repeated in-app purchases.

          1. JohnFen

            Re: Market contraction incoming

            You don't mention the sort of app you wrote. As an app developer myself, I know that whether (and how much) people are willing to pay is hugely affected by what sort of app it is. A game? Forget it, unless it's on par with a full-fledged desktop game. Utilities are tough, too.

            Note that I'm not saying that devs shouldn't use the ad ecosystem. I'm just saying that in doing so, the app is degraded and you're exposing your users to a very slimy industry.

  12. Overflowing Stack

    Just charge for it

    I've got many apps on Google Play and the paid for ones generate more money than identical ad funded ones.

    I'm simply going to convert the ad ones into paid/subscription apps.

  13. stephanh

    app developers beware

    IANAL, but it seems Google haven't done their homework and/or are (ab)using app developers to test the waters on GDPR rulings.

    If "Non-personalised ads" sends out no personal information, then that is sufficient, there should be no need to have an "Ad free" option.

    If, on the other hand, "Non-personalised ads" still sends out personal information (such as a unique device number) and "Ad free" comes at a cost, then that is a clear GDPR violation.

    Moreover, if "Non-personalised ads" does not communicate very clearly to the user that still some personal information is being sent, that is yet another GDPR violation.

    When the sh*t hits the fan, app developers are probably legally responsible even though they used the Google-provided API, you may want to read Google's disclaimers most carefully.

  14. Pig Dog Bay
    Unhappy

    Wait and See

    I have several ad supported apps and paid versions without ads. So the options menu idea here would work for these. However I have an iOS app where you can remove ads with an In App Purchase, so it looks like I will have to create an ad free version of the app to satisfy consent option 3. I decided to use IAP purchases for the iOS app as Apple recommends this instead of separate lite/pro versions of an app.

    This is quite obviously a mess, even Google hasn't got a grip on it yet judging by the GDPR emails I been sent as mentioned in the article. Will 1000's of app developers, come the end of May, start receiving fines in the post? Will the app stores start removing non GDPR compliant apps? Will users start sending me emails demanding I should have asked their consent before they used my apps? I doubt it but will wait and see, and then act.

  15. Anonymous Coward
    Anonymous Coward

    I just take the binary, find the routine for adverts and insert no-ops. Tada ad-free app.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like