Device storage consent for app SDKs under Croatian law
Article 43(4) of the Electronic Communications Act allows storing or accessing data on a user's device only with consent given after clear and complete information, especially about the purposes. The two exceptions are storage needed solely to transmit a communication and storage needed for a service the user explicitly requested. The wording is about the user's device, not only the browser, so it is sensible to treat analytics, attribution and advertising SDKs inside an app as in scope. Article 170 sets fines of €13,270 to €132,720 for a legal person in breach. In practice that means listing every SDK, noting what it writes to the device and why, and starting the non-essential ones only after the user agrees. The same inventory feeds the Google Play Data safety form, which must declare data collected and shared through third-party SDKs and stay accurate and complete at all times.





