React Native Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: A React Native app collects biometric data for face unlock. Under GDPR, biometric data is classified as:
- Standard personal data
- Anonymous data
- Special category data (Correct answer)
- Pseudonymous data
Correct answer: Special category data
GDPR Article 9 classifies biometric data used for unique identification as special category (sensitive) data requiring explicit consent.
Question 2: What is the maximum fine under GDPR for the most serious violations?
- €10 million or 2% of global annual turnover
- €20 million or 4% of global annual turnover (Correct answer)
- €50 million or 5% of global revenue
- €5 million or 1% of global turnover
Correct answer: €20 million or 4% of global annual turnover
The highest GDPR tier imposes fines up to €20 million or 4% of global annual turnover, whichever is higher.
Question 3: Which React Native feature must be configured to comply with iOS's requirement that users be shown a purpose string before granting camera access?
- react-native-permissions plist entry
- NSCameraUsageDescription in Info.plist (Correct answer)
- AndroidManifest.xml permission tag
- CAMERA permission in app.json
Correct answer: NSCameraUsageDescription in Info.plist
iOS requires an NSCameraUsageDescription key in Info.plist containing a plain-language explanation of why the app needs camera access.
Question 4: Under the California Consumer Privacy Act (CCPA), what right allows consumers to request that a business delete their personal information?
- Right to portability
- Right to opt-out
- Right to erasure (Correct answer)
- Right to know
Correct answer: Right to erasure
The CCPA grants California consumers the right to request deletion (erasure) of their personal information held by a business.
Question 5: An app sends push notifications using Expo Notifications. Under GDPR, before storing a push token tied to a user's identity, the developer must ensure:
- The token is hashed with SHA-256
- A lawful basis for processing exists (Correct answer)
- The token expires within 24 hours
- The token is stored only on-device
Correct answer: A lawful basis for processing exists
Linking a push token to an identifiable user constitutes personal data processing under GDPR, requiring a valid lawful basis such as consent.
Question 6: Google Play requires that apps offering in-app subscriptions must clearly disclose which of the following before the user commits to purchase?
- The developer's registered business address
- Price, billing period, and how to cancel (Correct answer)
- The app's privacy policy URL only
- The subscription tier names only
Correct answer: Price, billing period, and how to cancel
Google Play billing policies mandate that subscription apps clearly display price, billing frequency, and cancellation instructions prior to purchase.
Question 7: When a React Native app is rejected by Apple for 'using a non-public API', what compliance rule has been violated?
- App Store Guideline 2.5.1 – using private APIs (Correct answer)
- App Store Guideline 5.1 – privacy violation
- App Store Guideline 4.2 – minimum functionality
- App Store Guideline 3.2 – business model
Correct answer: App Store Guideline 2.5.1 – using private APIs
Guideline 2.5.1 prohibits apps from using private, undocumented, or non-public APIs to ensure stability and security.
React Native Regulatory Frameworks & Compliance 3
A React Native app collects biometric data for face unlock.
Under GDPR, biometric data is classified as: