A developer releases an app update that silently changes the data-sharing scope beyond what was disclosed in the original consent. Under GDPR, the developer must:
-
A
Obtain fresh consent from users before processing data under the expanded scope
-
B
Update the privacy policy and notify users within 30 days
-
C
Rely on legitimate interest if the new use is compatible with the original purpose
-
D
Provide a 14-day opt-out window via email only