Data collection purposes disclosed to users

GDPR Art. 13 requires that data subjects be informed of the categories of data collected and the purposes of processing at the time of collection — not buried in a long-form privacy policy users will never read. CCPA §1798.100 similarly requires 'notice at collection' that discloses data types before or at the point where data is collected. An app that collects location data and sends it to a backend without ever explaining this to the user in context — even if the privacy policy mentions it — fails the informed-at-collection requirement. Google Play Data Safety's prominence means that mismatches between declared data collection and actual SDK behavior are publicly visible to users before they install.

Add contextual in-app notices at each data collection point. The notice must name the data type and its purpose — generic 'we collect data to improve your experience' copy does not satisfy GDPR Art. 13.

// Before requesting location for a feature
function NearbyContentScreen() {
  const [noticeShown, setNoticeShown] = useState(false)

  useEffect(() => {
    Alert.alert(
      'Location Used Here',
      'We use your location to show nearby listings. Your precise location is not stored — only a city-level radius is sent to our servers.',
      [{ text: 'Got it', onPress: () => setNoticeShown(true) }]
    )
  }, [])

  // render feature
}

For analytics, add a one-line in-app notice on the settings screen listing the data types collected (e.g., 'We collect screen views and tap events to improve navigation'). Update your privacy policy to list specific data types and retention periods, not just categories.