EU Digital Markets Act payment rules may apply
Why it matters
The EU Digital Markets Act (external eu-dma-2022-1925) grants EU users new rights around alternative payment processing on iOS as of 2024, creating new technical requirements and App Store review processes for apps targeting EEA users. Apps with existing GDPR consent flows also face ongoing obligations: GDPR Art.30 requires a Records of Processing Activities (RoPA), Art.37 may require a Data Protection Officer for apps processing data at scale, and Art.6 requires a documented legal basis for every processing activity. Undocumented legal bases are among the most common enforcement findings in GDPR audits.
Severity rationale
Info because EU regulatory signals require awareness and documentation rather than immediate code changes, but undocumented processing activities create enforcement risk that grows with user volume.
Remediation
Document the legal basis for each data processing activity (legitimate interest, consent, contract, legal obligation) in your privacy policy and internal Records of Processing Activities. Ensure a Data Processing Agreement is signed with all third-party processors — analytics providers, ad networks, cloud infrastructure providers.
Monitor Apple's DMA compliance updates for EU iOS distribution: alternative payment processing APIs are now available and may affect your App Store review process for EU builds. For GDPR consent flows already present in the codebase, verify the consent management platform records and stores consent in a format auditable by your legal team — a gdprConsentString in localStorage is not sufficient audit evidence on its own.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Privacy & Data Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 30 — Records of processing activities
- gdpr · Art. 37 — Designation of the data protection officer
- gdpr · Art. 6 — Lawfulness of processing — legal basis required for each processing activity
- external · eu-dma-2022-1925 — EU Digital Markets Act (Regulation 2022/1925) — gatekeeper obligations for app store operators
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-privacy-data·automated