Can anonymized data be collected under GDPR without consent?
<p>I am having an Android App in which I want to track the usage of the app. But the usage will not have anyone identity for eg. I would collect one user used my app for around 10 minutes but who is that user I will have no clue.</p>

<p>Do I need to take a consent under GDPR before collecting those kind of data? </p>

<p>You do not need consent provided that the real person using your app indeed cannot be identified (other than by employing forensic technologies).</p>

<p>Source — <a href="https://gdpr-info.eu/recitals/no-26/" rel="nofollow noreferrer">Recital 26: Not applicable to anonymous data</a>.</p>

<p>It depends on what data you track. If, based on that data, user can be identified then those are "information concerning an identified or identifiable natural person" which falls under GDPR.</p>

<p><a href="https://iapp.org/news/a/looking-to-comply-with-gdpr-heres-a-primer-on-anonymization-and-pseudonymization/" rel="nofollow noreferrer">Check this for reference</a> and <a href="https://dataprivacylab.org/projects/identifiability/paper1.pdf" rel="nofollow noreferrer">this</a>:</p>

<blockquote>
  <p>As a well known study shows, it’s possible to personally identify 87 percent of the U.S. population based on just three data points: five-digit ZIP code, gender, and date-of-birth.</p>
</blockquote>

internet software privacy gdpr human-rights