GDPR liability for data that is no longer under the developer&#39;s control
<p>Let's say AdMob is used in a mobile app.  AdMob collects data and transfers it to Google.  There is no longer any access possible to the data by the developer.  Is the app creator liable for Google's use of the data?</p>

<p>A data controller is whoever determines the means and purposes of processing. It is possible that multiple controllers jointly determine the means and purposes. However, someone can only be controller over processing activities where they actually have the ability to influence these decisions (see e.g. the Fashion ID case).</p>
<p>The provider of an app does not have any control over what Google does on its servers with the collected data, unless Google were a data processor for that particular processing activity. Thus, the app provider is not a data controller for Google's subsequent processing, and is not responsible for Google's GDPR compliance.</p>
<p>HOWEVER, the app provider is a data controller regarding what happens within the app (including any SDKs, libraries, or frameworks). The app provider is data controller for processing activities such as “collecting data” and “sending data to Google”. These processing activities must comply with the GDPR (if GDPR applies), for example they need a legal basis. Under some circumstances there might be a legitimate interest for sending data to another data controller. But in the context of behavioural advertising, such a legitimate interest would be very weak and would not pass the required balancing test. Instead, the app provider would likely have to collect consent.</p>
<p>This is very similar to the question of whether a website can embed content from Google services such as YouTube videos, which would necessarily share data with Google. I have written related answers <a href="https://law.stackexchange.com/a/55926/20476">here</a> and <a href="https://law.stackexchange.com/a/56006/20476">there</a>.</p>
<p>You are correct that many apps do not collect valid consent before showing ads. GDPR/ePrivacy enforcement in this space is rather lacking, especially since many offenders are outside of the EU. However, this doesn't mean such illegal data processing by apps would be OK.</p>

gdpr advertisements