Mobile App Design Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: A developer releases an app update that silently changes the data-sharing scope beyond what was disclosed in the original consent. Under GDPR, the developer must:
- Obtain fresh consent from users before processing data under the expanded scope (Correct answer)
- Update the privacy policy and notify users within 30 days
- Rely on legitimate interest if the new use is compatible with the original purpose
- Provide a 14-day opt-out window via email only
Correct answer: Obtain fresh consent from users before processing data under the expanded scope
When the purpose of data processing changes materially, GDPR requires obtaining new, specific consent rather than relying on the original consent.
Question 2: Google Play's Families Policy requires that apps targeting children or mixed audiences (children and adults) must:
- Comply with all applicable children's privacy laws and meet Google's additional content restrictions for family apps (Correct answer)
- Use only Google's in-app purchase system for any monetization
- Restrict session length and include mandatory break reminders
- Be submitted under a separate developer account dedicated to children's apps
Correct answer: Comply with all applicable children's privacy laws and meet Google's additional content restrictions for family apps
Google's Families Policy imposes content, advertising, and privacy requirements on top of applicable laws like COPPA for apps in the family space.
Question 3: Under the EU's ePrivacy Directive (Cookie Law), storing non-essential data on a user's mobile device requires:
- Prior informed consent from the user (Correct answer)
- Disclosure in the privacy policy only
- A legitimate interest assessment
- Notification within 72 hours of first data storage
Correct answer: Prior informed consent from the user
The ePrivacy Directive requires prior consent before placing non-essential cookies or similar tracking technologies on a user's device.
Question 4: An app designed for US public school students (K-12) collects student data. Which law primarily restricts the commercial use of this data?
- FERPA (Family Educational Rights and Privacy Act) and applicable state student privacy laws (Correct answer)
- COPPA exclusively, if students are under 13
- HIPAA if any student health records are involved
- FTC Act Section 5 only
Correct answer: FERPA (Family Educational Rights and Privacy Act) and applicable state student privacy laws
FERPA restricts disclosure of student education records, and many states have additional student privacy laws (like SOPIPA) prohibiting commercial use of K-12 data.
Question 5: A mobile payment app must comply with PCI DSS. Which design decision most reduces the app's PCI DSS compliance scope?
- Tokenizing cardholder data so the app never handles raw PAN data (Correct answer)
- Encrypting PAN data with AES-256 before storing it locally
- Using TLS 1.3 for all payment API calls
- Displaying only the last four digits of the card number in the UI
Correct answer: Tokenizing cardholder data so the app never handles raw PAN data
Tokenization replaces the PAN with a non-sensitive token, so the app never touches raw card data and is largely removed from PCI DSS scope.
Question 6: The Americans with Disabilities Act (ADA) Title III has been interpreted by US courts to apply to mobile apps when:
- The app is the digital counterpart of a physical 'place of public accommodation' (Correct answer)
- The app is used by more than 500,000 users annually
- The developer receives any US federal funding
- The app is distributed through the Apple App Store or Google Play
Correct answer: The app is the digital counterpart of a physical 'place of public accommodation'
Courts have generally applied ADA Title III to apps with a sufficient nexus to a physical place of public accommodation, such as a retailer's or bank's app.
Question 7: An app automatically renews a paid subscription without sending a pre-renewal reminder to US users in California. This violates:
- California's Automatic Renewal Law (ARL), which requires clear disclosure and a reminder notice before renewal (Correct answer)
- CCPA's right to opt-out of data sale
- FTC's CAN-SPAM Act requirements
- Apple App Store subscription renewal rules only
Correct answer: California's Automatic Renewal Law (ARL), which requires clear disclosure and a reminder notice before renewal
California's ARL requires clear disclosure of auto-renewal terms and, for annual subscriptions, advance notice before the renewal charge.
Mobile App Design Regulatory Frameworks & Compliance 5
A developer releases an app update that silently changes the data-sharing scope beyond what was disclosed in the original consent.
Under GDPR, the developer must: