The era before mobile apps
We won't go too far back in history — we'll limit ourselves to an overview of requirements for websites, since from a user's perspective they're the closest equivalent to mobile apps. Like mobile apps, websites are published on the internet, can be published on behalf of various developers, and collect and process user data. The one significant difference is that websites don't undergo any initial moderation before publication.
Interesting fact. The world's first data protection law was passed in Germany. In 1970, the state of Hesse published a law with requirements for the machine processing of user data by government bodies. You can read the full text of the law on the German data protection archive's website: link to the law (in German).
From the very start of the IT industry's rapid growth in the 1970s, various countries began issuing laws and requirements around processing user data. But the first document that mass-obligated website owners to make visible changes to their sites was the «California Online Privacy Protection Act (CalOPPA)», passed in the US in 2004. It required websites to let any user from California read a privacy policy. This applied to all commercial websites and to any website collecting personally identifiable information — a fairly broad swath of the web. Since almost any American website could have a visitor from California and — more importantly — could actually be held liable, this requirement became the de facto standard for the entire US market. The fine for not providing a privacy policy was up to $2,500, though site owners were usually given 30 days to bring the site into compliance and avoid the fine.
The European Union had already adopted a more comprehensive document back in 1995. The «Data Protection Directive» (link to the document on the Publications Office of the European Union's website) was a directive, though, so it still had to be separately implemented through national laws, which is what determined the actual liability in case of violations. The document also covered all methods of processing information (including non-automated systems such as paper filing systems). While the obligation to disclose the purpose of data collection was present in the directive, there were no specific requirements for how this should be implemented.
The early era of third-party mobile apps (2008–2013)
The App Store launched in July 2008, and the Android Market followed that October. Interestingly, although the CalOPPA law mentioned earlier applied not just to websites but to «online services» too, developers at many American companies didn't bother making a privacy policy accessible within their mobile apps for several years. Things got to the point where, in December 2012, the California Attorney General's office sued «Delta Air Lines» (link to the complaint on the California Department of Justice website). The airline won the case, though, since state laws can't impose restrictions on airline services. In January 2013, the California Attorney General's office published «Privacy on the go: Recommendations for the mobile ecosystem» (link to the document) with recommendations for mobile app developers, app platforms, and other participants in the ecosystem.
Despite losing the case against «Delta Air Lines», the landscape for mobile apps shifted when it came to privacy policies. In practice, this meant the App Store and Google Play created a field for a privacy policy link that app developers could (though weren't yet required to) fill in.
It's worth noting that similar developments were happening in the EU too, just without the high-profile lawsuits. Around the same time (2014), the «Düsseldorfer Kreis» — an informal association of data protection authorities — together with the Bavarian State Office for Data Protection Supervision, published guidance for mobile app developers on data protection requirements (link to the article on the BayLDA website).
Strengthening data protection: the Snowden case, GDPR, CCPA (2013–2020)
Starting in June 2013, Edward Snowden — an infrastructure analyst for a US National Security Agency (NSA) contractor — began disclosing information through the media revealing the scale of US intelligence surveillance of citizens across many countries. This sparked a broad global debate about data protection.
In the EU context, it's worth mentioning Austrian activist Maximilian Schrems' case against Facebook. He filed a series of complaints with the Irish data protection authority (where Facebook's EU headquarters is based) over a number of alleged violations of EU data protection rules. These included: retaining deleted messages, retaining deleted «friends» on the social network, and collecting data on people even without an existing profile (shadow profiles). The full list of complaints can be found on the «Europe versus facebook» website: link. Without wearing the reader down with every stage of the legal proceedings — in 2015, the Court of Justice of the European Union (CJEU) ruled to strike down the so-called «Safe Harbour» practice, which had allowed American companies that had self-certified on data protection to store and process data collected in the EU market.
GDPR (General Data Protection Regulation) was adopted in 2016 and took effect in 2018 — the EU's core regulatory document on data protection. It replaced the old «Data Protection Directive». In spirit and intent it was similar to the old document. The main, practically significant changes were:
- It's now a regulation rather than a directive — meaning it automatically takes effect across the EU without national laws needing to be passed;
- Uniform, substantial fines for violations — up to €20 million or 4% of global revenue.
The US also passed the CCPA (California Consumer Privacy Act) — the American counterpart to GDPR. It was passed in 2018 and took effect in 2020.
Practical changes to mobile apps in the GDPR era
Let's try to round up the significant practical changes that have happened in mobile apps around data protection in recent years. Not all of them were directly driven by GDPR, but growing public interest in data protection has clearly influenced them:
- Google Play made the privacy policy link field mandatory in 2017, and the App Store followed in 2018 — no longer optional;
- Apple has required filling out a questionnaire for «easy to read» privacy policies since 2020, Google since 2022;
- In 2023–2024, Google introduces mandatory developer account verification. If the developer is an individual, they need to submit documents confirming their identity and address. For a business, a DUNS number is required;
- Since 2022, iOS users must be able to delete their account from within the app itself. Google introduced a similar requirement in 2024;
- In 2024, the EU adopted the DMA (Digital Markets Act), covering a wide range of changes aimed at reducing control by «gatekeepers» — the largest tech companies. For mobile development specifically, the key change was that iOS app developers must now be able to distribute their app through channels other than the App Store. The effect of the new stores has been limited so far;
- In 2025, Apple updates its guidelines so that developers must now obtain explicit user consent before sending their data to a third-party AI service.
Conclusion
Data protection practices — even in the context of mobile apps — have changed dramatically since the App Store and Google Play (formerly Android Market) first appeared. That process of change is still ongoing. One of the central themes remains the gap between stated privacy policies and reality, the difficulty of understanding long privacy policy pages, and the increasingly active use of AI.
User rights are championed not only by government and supranational bodies, but also by individual activists like Edward Snowden and Maximilian Schrems.
