Do I need to worry about GDPR, CCPA, CalOPPA, if collecting anonymous usage for a non-commercial, no-ads app?
<p>I am developing a free, non-commercial Android App that does not use Ads or in anyway attempt to share their information with a third-party. However, I would like to include both Google Analytics and Firebase Crash Reporting which will collect anonymous data on app usage and report any issues with the app if it crashes. The information is only being collected for myself and is not intended to include any personally identifying information like names, emails, phone numbers, etc. It may include some unintended hints at a rough location.</p>
<p>I should add, both Google Analytics and Firebase Crash Reporting are opt-in and are not enabled until and when the user checks a box and saves it. The app is fully functional without it enabled.</p>
<p>I am trying to generate a private policy for it using a service that generates a privacy template based on a questionnaire. Certain answers to that questionnaire also increase the price of retrieving that policy. It is asking me whether I want to include wording for GDPR, CalOPPA, and CCPA, and I am not sure if or which of those I actually need. I suspect I'll need to include GDPR, but I'm not completely sure. The last two both cover California and it's not clear to me how they would apply for a non-commercial, no-ads free app.</p>
<p>What's the simplest way to make sure my app has an appropriate privacy policy?</p>

<p>The CCPA is in many ways similar to the GDPR. It applies to firms that profess the personal data of California citizens, just as the GDPR applies to firms that process the data of EU residents. If you expect to have any significant number of users from California you will probably we wise to comply.  Fortunately, most of the needed steps to comply with the CCPA will also be needed to comply with the GDPR, there should be little additional effort needed.</p>
<p>Even a site that hosts no ads and sells no information must still do some things to comply.</p>
<p>The <a href="https://en.wikipedia.org/wiki/Online_Privacy_Protection_Act" rel="nofollow noreferrer">California Online Privacy Protection Act of 2003</a> (CalOPPA) primarily requires that a site include a clear privacy policy, and there there be an easily found link to such a policy from a sites main or home page.  According to the Wikipedia article linked above:</p>
<blockquote>
<p>Neither the web server nor the company that created the website has to be in California in order to be under the scope of the law. The website only has to be accessible by California residents.</p>
</blockquote>
<p>The law apparently does not contain any enforcement provisions of its own. The Wikipedia article states that:</p>
<blockquote>
<p>CalOPPA is expected to be enforced through California's Unfair Competition Law (UCL), which prohibits unlawful, unfair, or fraudulent business acts or practices. UCL may be enforced for violations of CalOPPA by government officials seeking civil penalties or equitable relief, or by private parties seeking private claims.</p>
</blockquote>
<p>Thus CalOPPA  is not really a Data Protection law like the GDPR or the CCPA. Rather it requires disclosure of privacy practices, whatever they may be.</p>
<p>See Also <a href="https://oag.ca.gov/sites/all/file/agweb/pdfs/cybersecurity/making_your_privacy_practices_public.pdf" rel="nofollow noreferrer">&quot;Making your Privacy Practices Public&quot;</a> by KD Harris.</p>

gdpr privacy