What GDPR Is
The General Data Protection Regulation is the European Union's core data protection law. It applies across all EU member states and the wider European Economic Area, and it has been in force since 25 May 2018. After Brexit, the UK kept an almost identical law, the UK GDPR, alongside its Data Protection Act.
GDPR is built on a few principles: process personal data lawfully, fairly and transparently; collect it for specific purposes; keep only what you need; keep it accurate; store it no longer than necessary; and protect it. Organisations must be able to show they follow these principles, not just claim to.
This entry is a general explanation for growth and product teams, not legal advice. Your obligations depend on your app, your users and your data flows.
Who GDPR Applies To
GDPR applies to organisations established in the EU, and to organisations elsewhere that offer goods or services to people in the EU or monitor their behavior there. For mobile apps, that usually means any app available to and used by people in the EU, especially if it runs analytics or advertising measurement on them.
The law separates two roles. A controller decides why and how personal data is processed. A processor handles data on the controller's behalf. In attribution, the app publisher is typically the controller and the MMP is typically a processor, with a data processing agreement setting out what the processor may do. Ad networks that use data for their own purposes may act as controllers themselves.
What Counts as Personal Data in Attribution
Personal data under GDPR is any information about an identified or identifiable person. That is broader than names and emails. Advertising IDs such as the IDFA and GAID, vendor IDs, IP addresses, cookie IDs and customer user IDs can all be personal data when they can be linked to someone.
Hashing does not take data out of scope. A SHA-256 hash of an email address is pseudonymised personal data: it is harder to read but still tied to a person. Truly anonymous data, which cannot be linked back to anyone by reasonable means, falls outside GDPR, but very little attribution data meets that bar.
Lawful Basis and Consent
Every processing activity needs one of six lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interests. Advertising measurement usually relies on consent or legitimate interests, and the choice has consequences for how you design your app.
Separately, the EU ePrivacy Directive requires consent to store or access information on a user's device unless it is strictly necessary for a service the user asked for. Reading identifiers for ad attribution is generally not considered strictly necessary, which is why most apps serving EU users show a consent prompt. Consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.
In practice, many apps use a consent management platform that records choices and shares them with partners through the IAB Transparency and Consent Framework. Google also requires consent signals, through Google Consent Mode, for measurement and personalisation of users in the EEA.
User Rights
GDPR gives people rights over their data: to be informed, to access it, to correct it, to erase it, to restrict or object to processing, to data portability, and rights related to automated decision-making. Your measurement setup should let you find and delete a user's data across systems when asked, including data held by processors such as your MMP.
How Linkrunner Supports GDPR Programs
Linkrunner shows a GDPR badge on its Trust Center, offers a data processing agreement at /legal/dpa, and supports consent-aware measurement: the iOS SDK reads TCF consent, Google DMA consent signals can be passed, PII hashing is an opt-in SDK setting, and the IDFA is collected only with ATT consent. Data is hosted in India, so EU data leaves the EEA; review transfer safeguards with your legal team. Teams that need data in their own cloud can use Bring Your Own Cloud.