Systematic review identifies three dominant GDPR privacy challenges in mobile app development

Researchers have completed a systematic review of the academic literature on GDPR privacy compliance in mobile applications, uncovering which privacy concerns dominate the field and where significant research gaps remain.

The Three Main Privacy Focuses#

The study analyzed 60 peer-reviewed papers investigating how mobile apps address privacy obligations under the EU's General Data Protection Regulation. Three issues consistently emerged as the central focus of existing scholarship:

• Direct personal data collection — how and when apps gather information straight from users
• Third-party data sharing — how personal information flows from apps to external partners and services beyond the app itself
• User consent mechanisms — how apps obtain, document, and manage consent as the legal justification for processing personal data

These findings underscore that the software engineering research community has concentrated its efforts on the most visible forms of data handling, particularly when explicit user permission is involved.

Research Gaps Requiring Attention#

Despite the volume of existing work, the systematic review identifies three critical areas where research remains insufficient:

Indirect data collection: Many papers overlook how personal information can leak through less obvious channels—such as permissions requests, system APIs, and device features—without direct user input.

Alternative legal bases: Current research emphasizes consent-based collection. However, GDPR permits data processing under other conditions (legitimate interest, legal obligation, contract fulfillment, and others). How these alternatives shape mobile app design and development practices remains largely unexplored.

Implementation of user rights: The regulation grants individuals rights to access, correct, delete, and port their data. The practical steps required to build these rights into mobile app architecture remain underexplored in the academic literature.

Why This Matters#

Because GDPR applies to any software handling data from EU residents anywhere in the world, mobile app developers everywhere face these compliance requirements. Closing these research gaps could help developers build privacy protections that go beyond surface-level consent management and address the full lifecycle of personal data in mobile environments.