An app you do not measure is flown blind. You want to know which screens really get used, where new users drop off, whether the feature that took three weeks is being used at all. The usual answer is to add an analytics tool in a few lines of code. That is often where the trouble starts: by default these tools send far more than you need, and EU law is stricter than people think, especially in Belgium.
The rule is not only about cookies
The reference text is the EU ePrivacy Directive. Its Article 5(3) only allows storing information on a user’s device, or accessing information already stored there, with their consent, unless it is strictly necessary to transmit a communication or to provide a service they have explicitly requested.
People associate it with cookie banners on websites, but it applies to apps too. The European Data Protection Board spelled this out in guidelines adopted in October 2024: smartphones are terminal equipment, a code library embedded in the app that sends information back triggers the rule, and collecting a unique identifier in a mobile application counts as accessing the device. The regulation that was meant to replace this directive was abandoned by the Commission in 2025: so the directive is what applies.
In Belgium, no exemption for analytics
This is the point many Belgian businesses miss. In France, the CNIL accepts that some audience measurement can do without consent, under strict conditions: a purpose limited to audience measurement, no cross-referencing with other data, a tool specific to a single publisher, a truncated IP address and a lifetime capped at 13 months. The Belgian Data Protection Authority offers no such flexibility. It states that a cookie used for analytics does not, in principle, meet the exemption conditions, and makes clear that its rules address the people responsible for websites and mobile apps alike.
In practice, a Belgian app that stores or reads an identifier on the phone for its analytics should, in principle, ask the person for consent. EU proposals under discussion could relax the rules for audience measurement, but nothing has been adopted so far.
Anonymous and pseudonymous are not the same
The second misunderstanding concerns the word “anonymous”. The GDPR does not apply to truly anonymous information. But its Recital 26 is clear: pseudonymised data, which could be attributed to a person using additional information, is still data about an identifiable person. A random identifier assigned to each phone, with no name or email address, is therefore not anonymous: it lets you follow the same person from one session to the next.
The Court of Justice of the European Union nuanced this in September 2025: pseudonymised data is not necessarily personal data for everyone, for instance for a recipient with no means of re-identifying people. For whoever collects the data and holds the key, however, it remains personal data. For an app publisher, the practical conclusion does not change.
The best data to protect is still the data you never collected.
What the stores ask you to declare
Apple and Google add their own layer of transparency, shown on the app’s listing. At Apple, you must declare everything the app collects, including what the third-party tools it embeds collect: analytics, advertising, external libraries. Data processed only on the device does not count as collected. For data to be “not linked” to the person, Apple requires it to be stripped of any direct identifier before collection, and never linked back to an identity afterwards. “Tracking”, which triggers iOS’s permission prompt, means combining your data with other companies’ data for advertising purposes, or sharing it with a data broker.
Google Play requires an equivalent form, the Data safety section, for every published app. There too, what stays on the device is not collection, and transferring fully anonymised data is not sharing. In both cases, you are the one answering, and you are responsible for the answers being accurate, including for code you did not write.
Measuring without spying, in practice
None of this forbids measuring. It forces you to measure with method. The principles we apply to our own products:
- Decide on the questions first: every measured event must answer a specific product question. Nothing else gets sent.
- Measure actions, not content: “a book was opened”, never its title; “a search happened”, never what was typed.
- Prefer counters to profiles: the number of people who finish onboarding answers most questions, without rebuilding each person’s journey.
- Pick a tool that sells nothing on and keeps its data in the European Union, then read what it collects by default.
- Leave users in control: ask for consent where the law requires it, and in every case provide a clear switch in the settings.
This is not legal advice: for a specific case, a lawyer remains the right person, and the rules depend on the country your users live in. It is, however, a topic to raise from the moment a product is scoped, because measurement planned from the start costs little, and a badly chosen tool is hard to remove. It is work we take on in product engineering, just like the obligations that apply to social apps. Tell us what you want to measure: we will help you find out without collecting any more.