Factory app updates: privacy compliance checks
Review the update against the approved app: map added permissions, trackers, recipients and purposes, confirm the lawful basis, revise privacy information and obtain fresh consent where required. Test actual behaviour before release. Coordinate the factory evidence through Cambridge China Bridge.
Ask for a privacy change record
Ask the factory and app developer for a comparison with the approved release. Include permissions, tracking components, collected information, receiving organisations, storage locations, retention settings and purposes. Request changes to server-side processing too, even where the app screens look unchanged.
Identify who approves each data use across your business, the factory and the app provider. Keep this review alongside the release controls in our guide to approving factory firmware and software. Ask for a test build and matching configuration before accepting the update.
Review purposes before choosing a lawful basis
You must determine the lawful basis before processing begins. For each changed use, record the previous purpose, proposed purpose and proposed basis. Ask whether the update changes the purpose itself or only how an existing feature works. Refer uncertain decisions to your privacy adviser before enabling the changed processing.
Treat labels such as diagnostics or service improvement as questions to investigate. Ask what information is actually used, who receives it and whether it supports advertising, profiling or another separate purpose. Do not approve a new use simply because the factory says the information was already collected.
Check tracker exemptions and consent scope
For storage and access technologies, confirm with the ICO or your privacy adviser whether consent is required and whether a relevant exemption applies. Ask the developer to explain each claimed exemption against the actual purpose and configuration. A component described as analytics or security needs a specific assessment, rather than approval based on its name.
Consent options must be separate for different purposes. For storage and access technologies, fresh consent is required when purposes or activities change beyond the original consent request. Compare the proposed use with the wording users previously saw. Ask your adviser whether a phone permission prompt adequately covers that use.
Renew notices where processing changes
Privacy information must cover all processing. Update it to describe the changed use, then plan how existing users will encounter that explanation. Ask for a short notice at the relevant update or feature screen, supported by accessible detail in the app settings.
Explain why a new permission is requested, what information the feature uses and which organisations receive it. Keep notice acknowledgement and consent choices distinct in the design. Test the journey for an existing account as well as a new installation, including users who previously refused optional processing.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Make release approval depend on evidence
Test whether consent-dependent trackers stay inactive before agreement, whether refusal is respected and what happens after withdrawal. Compare network traffic with the change record. Check that a background component or remote configuration does not enable a use the interface shows as disabled.
Retain the tested build, configuration, notice wording, consent screens and approval record. Agree how the factory will report later changes and how optional processing can be disabled while defects are corrected. Review security documentation separately using our PSTI guide.
Frequently asked questions
Does every app update need fresh consent?
Assess what changed and the scope of existing consent.
Can a phone permission prompt cover the new data use?
Compare the prompt with the actual purpose and recipients. Ask your privacy adviser whether it covers the proposed use, rather than accepting a screenshot as sufficient evidence.
What should I request from the factory?
Request a privacy change record, test build, server configuration, tracker list, proposed lawful bases, revised notices and consent screens. Include evidence of behaviour after refusal and withdrawal.
Can we approve the update from release notes alone?
Use release notes to start the review. Check the matching build and server configuration, inspect actual data flows and retain the evidence supporting approval.