Consent for analytics and SDKs in apps for Germany
Section 25 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) allows storing or reading information on a user's device only with consent given to GDPR standards, unless it serves solely to transmit a message or is strictly necessary for a digital service the user has expressly requested. The German supervisory authorities' guidance for digital services (OH Digitale Dienste, version 1.2, November 2024) applies this to apps as well as websites. It says that when a consent screen blocks content, rejecting must take no more clicks than consenting, and that a button labelled 'Einstellungen oder Ablehnen' leading to a further layer is not enough. It also declines to treat reach measurement as generally exempt, noting that third-party analytics services on websites and in apps regularly process extensive information about users. So analytics and attribution SDKs start only after consent, with the choice stored and reversible. The same SDK inventory feeds the Google Play Data safety form, which must cover data shared through third-party libraries, and the privacy manifest Apple requires for listed required-reason APIs.





