Mobile App Design Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: An app requests 'always on' background location permission on Android. Google Play policy requires the app to:
- Submit a Declaration Form and provide a compelling use case, reviewed by Google (Correct answer)
- Simply add ACCESS_BACKGROUND_LOCATION to the manifest
- Display a one-time in-app disclosure at first launch
- Obtain background location only through a foreground service
Correct answer: Submit a Declaration Form and provide a compelling use case, reviewed by Google
Google Play requires apps using background location to complete a permissions declaration and justify the need; Google reviews these declarations.
Question 2: A fintech app must comply with FinCEN's Bank Secrecy Act (BSA) requirements. Which design feature directly supports BSA compliance?
- In-app identity verification (KYC) flow that collects government-issued ID and performs AML screening (Correct answer)
- Two-factor authentication for login
- End-to-end encryption of transaction data
- GDPR-compliant data deletion on user request
Correct answer: In-app identity verification (KYC) flow that collects government-issued ID and performs AML screening
BSA/AML compliance requires Know Your Customer (KYC) identity verification and Anti-Money Laundering (AML) screening built into the onboarding flow.
Question 3: Under GDPR's data minimization principle, a mobile app should collect:
- Only the personal data that is adequate, relevant, and limited to what is necessary for the stated purpose (Correct answer)
- All data users are willing to provide to improve future features
- Data proportional to the app's revenue model
- No more than 10 data fields per user interaction
Correct answer: Only the personal data that is adequate, relevant, and limited to what is necessary for the stated purpose
GDPR Article 5(1)(c) requires data minimization: collecting only what is necessary for the explicitly stated processing purpose.
Question 4: Apple's App Store requires apps in the 'Kids' category to:
- Not include behavioral advertising or analytics that track users across apps and websites (Correct answer)
- Collect parental consent through Apple's sign-in system
- Be rated 4+ in all markets
- Limit session length to 30 minutes with a parental control API
Correct answer: Not include behavioral advertising or analytics that track users across apps and websites
Apple prohibits behavioral advertising and third-party analytics that track users across apps in the Kids category to protect children's privacy.
Question 5: A US-based healthcare app uses a third-party analytics SDK. Under HIPAA, this relationship requires:
- A signed Business Associate Agreement (BAA) with the analytics vendor (Correct answer)
- An addendum to the app's privacy policy only
- Pseudonymization of all health data before SDK ingestion
- No additional steps if the SDK is GDPR-compliant
Correct answer: A signed Business Associate Agreement (BAA) with the analytics vendor
Any vendor that processes PHI on behalf of a covered entity must sign a BAA establishing HIPAA compliance obligations.
Question 6: Which California law specifically requires operators of commercial websites and mobile apps to conspicuously post a privacy policy?
- California Online Privacy Protection Act (CalOPPA) (Correct answer)
- CCPA (California Consumer Privacy Act)
- California Consumer Protection Act
- California IoT Security Law (SB-327)
Correct answer: California Online Privacy Protection Act (CalOPPA)
CalOPPA (2003) was one of the first US laws requiring a conspicuous privacy policy for apps and websites collecting personal data from California residents.
Question 7: An app's dark pattern steers users toward a more expensive subscription tier by greying out the cheaper option. This most likely violates which regulatory principle?
- FTC Act Section 5 prohibition on unfair or deceptive acts and practices (Correct answer)
- GDPR's right to data portability
- COPPA's parental consent requirements
- PCI DSS Requirement 7 on access control
Correct answer: FTC Act Section 5 prohibition on unfair or deceptive acts and practices
The FTC's Section 5 authority covers deceptive design patterns (dark patterns) that manipulate consumer choices, and the FTC has issued guidance and enforcement actions on this.
Mobile App Design Regulatory Frameworks & Compliance 4
An app requests 'always on' background location permission on Android.
Google Play policy requires the app to: