Question

A privacy engineer is reviewing the design of a new mobile analytics SDK before release. The product team wants each event payload to include the user's full device identifier, precise account email, and raw GPS coordinates so that the analytics team can 'have everything available in case a future question comes up.' The stated business need is only to measure feature adoption rates by broad region and by whether a user is on a free or paid plan. Which design change best applies the privacy engineering principle at stake?

Accepted Answer

Send a pseudonymous session token instead of the email, replace raw GPS with a coarse region code, and drop the device identifier, so only the region and plan tier remain in the payload

Answer

Encrypt the full event payload at rest and restrict analytics table access to named analysts via role-based controls

Answer

Collect all fields as requested but add a retention timer that purges the raw analytics events after 24 months

Answer

Obtain explicit consent from users to collect the full identifiers, email, and precise GPS coordinates before the SDK transmits any event