K
Klivvr Blog

Privacy-First Analytics: GDPR and App Tracking Transparency

Implement privacy-compliant analytics in iOS apps, covering GDPR requirements, Apple's App Tracking Transparency framework, and consent management patterns.

technical7 min readBy Klivvr Engineering
Share:

Privacy regulation and platform enforcement have fundamentally changed how mobile analytics works. The era of tracking users across apps with impunity is over. GDPR, CCPA, and Apple's App Tracking Transparency (ATT) framework require analytics SDKs to be built with privacy as a first-class concern, not an afterthought. An analytics SDK that does not respect user consent is a legal liability and a rejection risk in App Store review.

This article covers how KlivvrAnalyticsKit approaches privacy-first analytics, from consent management to data minimization, and how to build analytics that deliver insights without compromising user trust.

Understanding the Regulatory Landscape

Before writing code, you need to understand what the regulations actually require. GDPR requires explicit consent before collecting personal data from EU users. CCPA gives California residents the right to opt out of data sales. Apple's ATT framework requires permission before accessing the device's advertising identifier (IDFA) or tracking users across apps and websites owned by other companies.

// Consent state management
enum ConsentStatus: String, Codable {
    case unknown      // User hasn't been asked yet
    case granted      // User opted in
    case denied       // User opted out
    case restricted   // Parental controls or MDM restrictions
}
 
struct ConsentState: Codable {
    var analyticsConsent: ConsentStatus = .unknown
    var advertisingConsent: ConsentStatus = .unknown
    var thirdPartyConsent: ConsentStatus = .unknown
    var consentTimestamp: Date?
    var consentVersion: String?  // Track which privacy policy version was accepted
 
    var canCollectAnalytics: Bool {
        analyticsConsent == .granted
    }
 
    var canTrackAdvertising: Bool {
        advertisingConsent == .granted
    }
 
    var canShareWithThirdParties: Bool {
        thirdPartyConsent == .granted
    }
}

The key insight is that consent is not binary. Users may consent to first-party analytics but not advertising tracking. Your SDK must handle granular consent levels.

A robust consent manager handles the full lifecycle: prompting, storing, respecting, and updating consent. It also needs to coordinate with Apple's ATT framework.

import AppTrackingTransparency
import AdSupport
 
final class ConsentManager: ObservableObject {
    static let shared = ConsentManager()
 
    @Published private(set) var consentState: ConsentState
    private let storage: UserDefaults
    private let consentKey = "com.klivvr.analytics.consent"
 
    init(storage: UserDefaults = .standard) {
        self.storage = storage
        if let data = storage.data(forKey: consentKey),
           let state = try? JSONDecoder().decode(ConsentState.self, from: data) {
            self.consentState = state
        } else {
            self.consentState = ConsentState()
        }
    }
 
    // Request ATT permission (iOS 14+)
    func requestTrackingAuthorization() async -> ATTrackingManager.AuthorizationStatus {
        let status = await ATTrackingManager.requestTrackingAuthorization()
 
        switch status {
        case .authorized:
            updateConsent(\.advertisingConsent, to: .granted)
        case .denied:
            updateConsent(\.advertisingConsent, to: .denied)
        case .restricted:
            updateConsent(\.advertisingConsent, to: .restricted)
        case .notDetermined:
            updateConsent(\.advertisingConsent, to: .unknown)
        @unknown default:
            updateConsent(\.advertisingConsent, to: .unknown)
        }
 
        return status
    }
 
    // Update granular consent
    func updateConsent(_ keyPath: WritableKeyPath<ConsentState, ConsentStatus>, to status: ConsentStatus) {
        consentState[keyPath: keyPath] = status
        consentState.consentTimestamp = Date()
        persistState()
        notifyAnalyticsOfConsentChange()
    }
 
    // Grant all analytics consent
    func grantAnalyticsConsent(policyVersion: String) {
        consentState.analyticsConsent = .granted
        consentState.consentVersion = policyVersion
        consentState.consentTimestamp = Date()
        persistState()
        notifyAnalyticsOfConsentChange()
    }
 
    // Revoke all consent and purge data
    func revokeAllConsent() {
        consentState = ConsentState()
        consentState.analyticsConsent = .denied
        consentState.advertisingConsent = .denied
        consentState.thirdPartyConsent = .denied
        consentState.consentTimestamp = Date()
        persistState()
 
        // Purge collected data
        KlivvrAnalytics.shared.purgeAllData()
        notifyAnalyticsOfConsentChange()
    }
 
    private func persistState() {
        if let data = try? JSONEncoder().encode(consentState) {
            storage.set(data, forKey: consentKey)
        }
    }
 
    private func notifyAnalyticsOfConsentChange() {
        NotificationCenter.default.post(
            name: .analyticsConsentDidChange,
            object: consentState
        )
    }
}
 
extension Notification.Name {
    static let analyticsConsentDidChange = Notification.Name("analyticsConsentDidChange")
}

The analytics pipeline must check consent before collecting, enriching, or transmitting any event. This is not a simple on/off switch -- different consent levels enable different data collection.

// Consent-aware event pipeline
final class ConsentAwareAnalytics {
    private let consentManager: ConsentManager
    private let pipeline: AnalyticsPipelineCoordinator
 
    func track(_ event: TrackableEvent) {
        guard consentManager.consentState.canCollectAnalytics else {
            // Log locally for debugging but don't collect
            Logger.debug("Analytics event suppressed (no consent): \(event.eventName)")
            return
        }
 
        var sanitizedEvent = event
 
        // Strip advertising identifiers if no ad consent
        if !consentManager.consentState.canTrackAdvertising {
            sanitizedEvent = stripAdvertisingData(from: sanitizedEvent)
        }
 
        // Strip third-party identifiers if no sharing consent
        if !consentManager.consentState.canShareWithThirdParties {
            sanitizedEvent = stripThirdPartyData(from: sanitizedEvent)
        }
 
        pipeline.track(sanitizedEvent)
    }
 
    private func stripAdvertisingData(from event: TrackableEvent) -> SanitizedEvent {
        var properties = event.properties
        properties.removeValue(forKey: "idfa")
        properties.removeValue(forKey: "advertising_id")
        properties.removeValue(forKey: "campaign_id")
        return SanitizedEvent(eventName: event.eventName, properties: properties)
    }
 
    private func stripThirdPartyData(from event: TrackableEvent) -> SanitizedEvent {
        var properties = event.properties
        properties.removeValue(forKey: "facebook_id")
        properties.removeValue(forKey: "google_id")
        properties.removeValue(forKey: "external_user_id")
        return SanitizedEvent(eventName: event.eventName, properties: properties)
    }
}

Data Minimization and Anonymization

Privacy-first analytics means collecting only what you need and anonymizing what you collect. IP addresses, precise locations, and device identifiers should be handled carefully.

// Data minimization enricher
struct PrivacyEnricher: EventEnricher {
    let consentState: ConsentState
 
    func enrich(_ event: inout AnalyticsEvent) {
        // Always add an anonymous session ID (not tied to identity)
        event.properties["anonymous_id"] = AnonymousIdManager.shared.anonymousId
 
        // Only add user ID if full analytics consent is granted
        if consentState.canCollectAnalytics {
            // Hash the user ID instead of sending it raw
            if let userId = event.properties["user_id"] as? String {
                event.properties["user_id_hash"] = userId.sha256Hash
                event.properties.removeValue(forKey: "user_id")
            }
        }
 
        // Coarsen location data -- city level only, no precise coordinates
        if let latitude = event.properties["latitude"] as? Double,
           let longitude = event.properties["longitude"] as? Double {
            event.properties.removeValue(forKey: "latitude")
            event.properties.removeValue(forKey: "longitude")
            event.properties["geo_region"] = GeoResolver.region(
                latitude: latitude.rounded(toPlaces: 1),
                longitude: longitude.rounded(toPlaces: 1)
            )
        }
 
        // Truncate IP to /24 subnet
        if let ip = event.properties["ip_address"] as? String {
            event.properties["ip_subnet"] = truncateIP(ip)
            event.properties.removeValue(forKey: "ip_address")
        }
    }
 
    private func truncateIP(_ ip: String) -> String {
        let components = ip.split(separator: ".")
        guard components.count == 4 else { return "unknown" }
        return "\(components[0]).\(components[1]).\(components[2]).0"
    }
}
 
// Anonymous ID that doesn't persist across app reinstalls (privacy-friendly)
final class AnonymousIdManager {
    static let shared = AnonymousIdManager()
 
    var anonymousId: String {
        if let existing = UserDefaults.standard.string(forKey: "klivvr_anonymous_id") {
            return existing
        }
        let newId = UUID().uuidString
        UserDefaults.standard.set(newId, forKey: "klivvr_anonymous_id")
        return newId
    }
 
    func resetAnonymousId() {
        UserDefaults.standard.removeObject(forKey: "klivvr_anonymous_id")
    }
}

Data Retention and Deletion

GDPR's right to erasure means your analytics system must support deleting a user's data on request. This needs to be handled at the SDK level for any locally queued events.

extension KlivvrAnalytics {
    /// Purge all locally stored analytics data
    func purgeAllData() {
        // Clear the event queue
        eventQueue.purgeAll()
 
        // Reset anonymous ID
        AnonymousIdManager.shared.resetAnonymousId()
 
        // Clear any cached user properties
        userEnricher.clearUserData()
 
        // Notify the backend to initiate server-side deletion
        Task {
            try? await requestServerDeletion()
        }
 
        Logger.info("All analytics data purged per user request")
    }
 
    /// Request server-side data deletion (GDPR right to erasure)
    private func requestServerDeletion() async throws {
        var request = URLRequest(url: deletionEndpoint)
        request.httpMethod = "DELETE"
        request.setValue(apiKey, forHTTPHeaderField: "X-API-Key")
 
        let payload = DeletionRequest(
            anonymousId: AnonymousIdManager.shared.anonymousId,
            requestedAt: Date()
        )
        request.httpBody = try JSONEncoder().encode(payload)
 
        let (_, response) = try await URLSession.shared.data(for: request)
        guard let httpResponse = response as? HTTPURLResponse,
              httpResponse.statusCode == 202 else {
            throw AnalyticsError.deletionRequestFailed
        }
    }
}

Practical Tips

Always request ATT permission at a contextually appropriate moment, not immediately at app launch. Explain to users why you are asking and what benefit they get from opting in. Store consent records with timestamps and policy versions so you have an audit trail. Test your consent flows thoroughly -- a bug that collects data without consent is a compliance violation. Consider offering a privacy dashboard within your app where users can review and manage their consent choices.

Conclusion

Privacy-first analytics is not about collecting less data -- it is about collecting data responsibly. With granular consent management, data minimization, anonymization, and deletion support built into KlivvrAnalyticsKit, you can deliver meaningful product insights while respecting user privacy and complying with regulations. The analytics SDKs that earn user trust will ultimately collect better data, because users who consent are users who engage.

Related Articles

business

Ensuring Data Quality in Mobile Analytics

Establish data quality practices for mobile analytics, including validation, monitoring, testing, and governance to maintain trustworthy analytics data.

7 min read