Question

A mobile development team is integrating a popular third-party analytics SDK into a new consumer health app. During a privacy engineering review, the engineer discovers the SDK, once initialized, automatically transmits device identifiers, coarse location, and app event data to the vendor's servers on app launch — before any user interaction. The product team wants to keep the SDK for its crash-reporting features. What is the MOST effective privacy-by-design action for the engineer to recommend?

Accepted Answer

Configure the SDK to defer initialization and disable non-essential data collection by default, enabling only the specific data streams required for crash reporting after they are justified

Answer

Add a disclosure in the privacy policy describing the SDK's data transmission and rely on the vendor's contractual commitments to safeguard the data

Answer

Allow the SDK to operate as designed but encrypt all outbound traffic to the vendor using TLS to protect the identifiers in transit

Answer

Present a consent banner on first launch allowing users to opt out of all analytics after the initial data transmission has occurred