Mobile analytics, privacy, and consent — Cheat Sheet — Practical Guide (Dec 24, 2025)

Mobile analytics, privacy, and consent — Cheat Sheet

body { font-family: Arial, sans-serif; line-height: 1.6; max-width: 800px; margin: 20px auto; padding: 0 15px; }
h2, h3 { colour: #2a4d69; }
pre { background: #f4f4f4; padding: 12px; border-radius: 4px; overflow-x: auto; }
p.audience { font-weight: bold; font-size: 1.1em; colour: #555; }
p.social { font-size: 0.9em; margin-top: 3rem; colour: #666; }
a { colour: #2a4d69; }

Mobile analytics, privacy, and consent — Cheat Sheet

Level: Intermediate Software Engineer

As of December 24, 2025

Introduction

Mobile analytics are vital for understanding user behaviour, optimising engagement, and driving business decisions. Yet, evolving privacy regulations (GDPR, CCPA, and others), platform changes (iOS 15+ App Tracking Transparency (ATT), Android privacy updates), and user consent requirements have raised the bar on how analytics can be implemented responsibly and legally.

This cheat sheet focuses on practical, actionable guidance for mobile developers and engineers aiming to integrate analytics tools while respecting privacy and securing proper consent. It emphasises stable, widely supported APIs and frameworks as of late 2025, covering both iOS and Android platforms.

Prerequisites

Understanding of mobile app development for iOS (Swift/Obj-C) or Android (Kotlin/Java).
Familiarity with common analytics services e.g., Firebase Analytics, Segment, Amplitude, or custom solutions.
Basic knowledge of privacy laws relevant to your users, especially GDPR (EU), CCPA (California), and applicable regional laws.
Registered with Apple Developer Program and Google Play Console for platform-specific consent APIs.
Access to your app’s backend (if relevant) to store or process consent status securely.

Hands-on steps

1. Choose an analytics SDK with built-in privacy support

By late 2025, most major analytics platforms provide configurable options to disable data collection until user consent is obtained. For example:

Firebase Analytics: delay initialisation until consent is granted; use setAnalyticsCollectionEnabled(false) as default.
Amplitude & Segment: similarly, require explicit opt-in before sending events.
Custom SDK: implement your own consent gating and event buffering logic.

2. Implement platform-specific consent prompts

On iOS (15.0+), integrate AppTrackingTransparency framework:

// Request tracking permission
import AppTrackingTransparency
import AdSupport

func requestTrackingConsent(completion: @escaping (ATTrackingManager.AuthorizationStatus) -> Void) {
   ATTrackingManager.requestTrackingAuthorization { status in
      DispatchQueue.main.async {
         completion(status)
      }
   }
}

This status determines whether you can access the IDFA for attribution purposes or must fall back to alternative identifiers.

On Android (Android 12+), respect platform’s privacy changes by:

Complying with the Google Play Services Advertising ID opt-out/limit ad tracking flags.
Using the Google Play Consent SDK or your own UI prompt for GDPR and CCPA compliance.

3. Build your own explicit consent UI

GDPR and other regulations require clear, unambiguous consent for personal data processing. Pre-empt automatic data collection until consent is given.

// Example pseudo-code for Android consent button
consentButton.setOnClickListener {
   showConsentDialog {
       if (userConsents) {
           Analytics.enableDataCollection(true)
           saveConsentStatus(true)
       } else {
           Analytics.enableDataCollection(false)
           saveConsentStatus(false)
       }
   }
}

Remember to store consent status securely, locally, and if necessary, on your backend, so analytics persist consent across installs or devices when permitted.

4. Defer analytics initialisation until consent

To avoid accidental data capture, initialise or activate analytics SDKs only after consent.

Example for Firebase on iOS (Swift):

if userHasConsented {
  FirebaseApp.configure()
  Analytics.setAnalyticsCollectionEnabled(true)
} else {
  Analytics.setAnalyticsCollectionEnabled(false)
}

For Android, control collection similarly, relying on setAnalyticsCollectionEnabled methods.

5. Provide users with easy access to revoke consent

Privacy laws require user rights to revoke consent anytime.

Offer a setting or modal in-app to withdraw consent.
On revocation, disable data collection immediately and delete stored personal data if required.

Common pitfalls

Collecting PII before consent: Avoid sending personally identifiable information (PII) or analytics events until consent is explicit.
Misunderstanding ATT scope: ATT restricts tracking via IDFA, but does not ban all analytics. Adjust events and identifiers accordingly.
Ignoring regional legal nuances: GDPR mandates opt-in, CCPA requires opt-out with disclosure. Know your user location.
Lack of transparency: Always provide users with clear, plain-language privacy notices and consent explanations.
Failure to persist consent: When user uninstalls/reinstalls, storing consent status properly is critical (e.g., iCloud key-value storage or secure backend).

Validation

Testing consent flows

Use device simulators and real devices to trigger consent prompts repeatedly.
Verify analytics events are blocked until consent is given.
Test different consent grant states—granted, denied, and deferred.
Simulate uninstall/reinstall cycles to verify persistent consent storage.

Monitoring and Auditing

Use log monitoring (e.g., Firebase DebugView, Amplitude Debug API) to confirm no data is sent without consent.
Regularly audit analytics dashboards and raw data exports for compliance.
Validate compliance with automated app scanning tools (e.g., App Store Connect Privacy Report, Play Console Data Safety section).

Checklist / TL;DR

Understand applicable privacy laws for your users.
Choose an analytics SDK that supports consent gating and data collection toggling.
Implement explicit, platform-tailored consent prompts (iOS ATT, Android opt-in/out).
Defer analytics SDK initialisation and event sending until consent is granted.
Persist user consent status securely and transparently.
Provide clear UI for users to revoke or change consent at any time.
Test across all typical and edge consent scenarios before release.
Monitor, audit, and update consent logic regularly in line with evolving policies.

When to choose X vs Y

Firebase Analytics vs Other analytics providers: Firebase offers deep integration with Google services and is free with generous quotas, but if you want more advanced segmentation or privacy-first analytics, consider platforms like Amplitude or Plausible which offer more anonymised or consent-focused models.

Platform Consent SDKs vs Custom UI: Platform SDKs like Apple’s ATT or Google’s Play Consent SDK provide official consent prompts verifying system-wide tracking permissions. However, national laws often require additional purpose-specific consents, so combining platform SDKs with custom consent UIs ensures both legal and functional compliance.