GDPR/CCPA consent UI displayed where required

Collecting analytics or behavioral data from users in the EU without a consent UI violates GDPR Art. 7 (conditions for consent) and the ePrivacy Directive Art. 5(3). In California, CCPA §1798.100 requires disclosure and opt-out rights before selling or sharing personal information. Apps that initialize analytics SDKs unconditionally — before checking persisted consent — are non-compliant regardless of whether they display a banner later. Google Play's Data Safety section and Apple's App Store privacy label are public-facing disclosures; regulators and users can compare them against actual SDK behavior. A consent UI that does not gate SDK initialization is cosmetically compliant but legally exposed: the DPA enforcement record consistently shows that the banner must actually stop data flow, not just record a preference.

Gate all analytics SDK initialization behind a persisted consent check. The SDK must not call any tracking method until userConsent === 'true' is read from storage.

import AsyncStorage from '@react-native-async-storage/async-storage'
import { initAnalytics, disableAnalytics } from './analytics'

export async function bootstrapWithConsent() {
  const consent = await AsyncStorage.getItem('gdpr_consent')

  if (consent === 'accepted') {
    initAnalytics({ sampling: 1.0 })
  } else {
    // Do NOT initialize — SDK stays silent until user consents
    disableAnalytics()
  }
}

// Call on app start, before any navigation
bootstrapWithConsent()

The consent UI must offer a real decline option — "Accept" and "Settings" are not equivalent to "Accept" and "Decline". Store the user's choice and re-check on every app launch.