Third-party SDKs comply with privacy requirements

GDPR Art. 28 requires a Data Processing Agreement with every third-party vendor that processes personal data on your behalf. Apple's Privacy Manifest requirement (since May 2024) means that any third-party SDK accessing protected APIs must be declared — if the SDK is not in your iOS privacy manifest, Apple rejects the submission. Google Play Data Safety requires disclosure of every SDK that collects or shares data, including the data types and purposes. An SDK that is configured to collect aggressively (e.g., full session replay, uncapped event logging) without a user-facing opt-out mechanism can create CCPA violations independently of your own app's consent UI — the SDK acts on your behalf, and its data collection is attributed to you.

Audit every entry in package.json that handles user data and verify each is declared in your Google Play Data Safety form and iOS Privacy Manifest. Gate aggressive features behind consent checks.

// Gate third-party SDK initialization behind consent
const consent = await AsyncStorage.getItem('gdpr_consent')

if (consent === 'accepted') {
  // Enable full analytics
  Analytics.init({ sessionReplay: true, eventSampling: 1.0 })
  Crashlytics.setCrashlyticsCollectionEnabled(true)
} else {
  // Minimal or disabled
  Analytics.init({ sessionReplay: false, eventSampling: 0 })
  Crashlytics.setCrashlyticsCollectionEnabled(false)
}

Check each SDK's privacy manifest documentation: Firebase, Amplitude, Segment, and Braze all publish the required NSPrivacyAccessedAPITypeReasons codes you must include in ios/PrivacyInfo.xcprivacy.