GDPR App Audit: Tracking, Consent and Data Flows
A GDPR app audit establishes what your app does with personal data from the first moment after launch. The Squad decompiles the shipped build, lists every SDK and endpoint, and checks the findings against the articles that regulators ask about first: lawfulness, consent, transfers to third countries and special-category data.
Tracking before consent
The most frequent finding in our ledger is an SDK that starts before the consent screen appears. Content providers declared in the manifest initialise when the process starts, so analytics and advertising libraries run before the user has chosen anything. Consent-mode defaults set to "granted" inside the binary have the same effect.
Article 5(3) of the ePrivacy Directive covers access to the terminal equipment and is the legal backbone of every SDK-consent finding we publish. GDPR Article 6 (lawful basis) and Article 7 (conditions for consent) sit next to it, together with the principles in Article 5.
Data flows to third countries
The audit reconstructs where data goes: every endpoint the app contacts, the company behind it and the country it resolves to. Transfers to third countries need a legal basis under Articles 44 to 46. The ledger documents apps that send data to a country without an adequacy decision or a documented safeguard, and an app whose own consent page still cites the EU-U.S. Privacy Shield.
A transfer finding names the SDK or endpoint, shows the evidence in the binary and states which data categories travel.
Special-category and children's data
Microphone, camera, health and biometric data fall under Article 9. Children's apps add Article 8 and COPPA. The audit looks for permissions without a feature that explains them, for biometric data flowing to third parties, and for age gates and consent mechanisms that the code never enforces.
Code against policy
The central method is a comparison. Your privacy policy, your consent screen and your store disclosures describe what the app should do. The binary shows what it does. Every difference becomes a finding with its evidence. Where policy and code agree, the report says so too.
The report follows the same five questions as every audit we deliver: what we found, what proves it, how we proved it, how sure we are, and what to do about it.
Who does the work
The Squad is human-powered multi-agent security investigation. Agents built and trained in house execute the broad testing across code, dependencies, APIs and configurations. Human specialists examine each result in its technical context and re-verify every finding before it reaches the report. Reviews run on infrastructure in Europe, with processing in Graz.
Evidence from audited apps
The public ledger lists 387+ audited apps and 262+ critical findings. These full reports show the GDPR finding classes in real apps:
- Geizhals: Facebook and Firebase SDKs start automatically before the consent screen.
- Coinbase: Consent-mode defaults hardcoded to "granted", with no consent management platform in the binary.
- Dundle: Tracking consent defaults to granted before any user choice.
- DeepSeek: Personal data stored in the People's Republic of China per the app's own policy, plus SDKs that start behind a single "Agree" button.
- Revolut: A financial-relationship graph sent to a US company with no EU adequacy decision.
Start with the free check
The free check examines one domain from the outside: read-only, from a European IP address, with no login and no payloads. A researcher reviews your request and replies within one business day. You receive a short written report with findings, likely attack scenarios, potential financial impact and next steps, plus a knowledge graph. It is an initial external assessment, so it complements a full GDPR app audit and does not replace it.
The plans for a full audit are on the Access page.
See plans and pricing → · Meet The Squad → · Standards and frameworks →
The initial check is read-only, performed from a European IP address, with no login and no payloads. Your systems remain unchanged.
A researcher reviews your request before any check begins and replies within one business day. You receive a short written report with our findings, likely attack scenarios, the potential financial impact and clear next steps, plus a knowledge graph of everything we found. All free.
Questions about GDPR app audits
Which GDPR articles does the audit refer to?
Typically Article 5 (principles), Article 6 (lawful basis), Article 7 (consent), Article 8 (children), Article 9 (special categories), Articles 44 to 46 (third-country transfers) and Article 33 (breach notification), together with Article 5(3) of the ePrivacy Directive for terminal-equipment access.
Does the audit show whether our consent banner works?
It shows what the build does before and independent of the banner: which SDKs initialise at start, which consent defaults the code sets and which endpoints receive data.
Is the report legal advice?
The report documents technical facts and maps them to articles. The legal assessment stays with your data protection officer or counsel.
Do you also cover SDKs from vendors we do not control?
Yes. Third-party libraries and their versions are part of the scope, because their behaviour is part of what your app does.
Related pages
App Security Audit · NIS2 for Software Vendors · Tracker & SDK Check
