Your Website Honours the Opt-Out. Your App Has Never Heard of It.
Nearly every CCPA control most companies own is a browser control. Ship an AI feature in a mobile app and you leave that stack behind entirely — no banner, no cookie inventory, no GPC signal — while adding a vendor, a data category and a public privacy label.
What the Web Stack Was Quietly Doing For You
A privacy programme built for the web inherits a lot of machinery: a consent management platform that enumerates tags, a footer link the regulation's rules were written around, a browser that transmits an opt-out preference without anyone implementing it, and scanners that can inventory third-party requests from outside. None of that exists on mobile.
The result is that companies with mature web compliance frequently have an app that has never been assessed, and the gap widens the moment an AI feature ships, because that feature adds a data flow no existing control governs.
Four Gaps That Open With the AI Release
Inventory the Binary, Not the Documentation
Asking the mobile team which SDKs are in the app produces the list they remember adding. Dependency manifests are better and still incomplete, because SDKs pull transitive dependencies that also make network calls. The authoritative answer comes from the build and from traffic:
- Dependency graph, fully resolved. Not the top-level manifest — the resolved tree, including what your analytics vendor bundles.
- Platform privacy manifests. Both major platforms now require declarations from SDK vendors about data collection and tracking domains. That is a supplier-attested inventory sitting inside your own build.
- Observed egress. Run the app through a proxy on a clean device and record every domain contacted during a session that exercises the AI feature. This finds recipients no document mentions, and it takes an afternoon.
- The same run with the opt-out enabled. The comparison is the actual test of whether your control does anything. A domain list that is identical before and after is the finding.
Where On-Device Processing Earns Its Cost
On-device inference is usually argued on latency and offline support. The compliance case is stronger than either: content that never leaves the handset generates no disclosure, no sale-or-share analysis, no subprocessor entry and no vendor deletion path. It converts a governance problem into a product decision.
The qualifier is that hybrid architectures are common and rarely documented as such. A feature described as on-device may fall back to a hosted model on older hardware, send telemetry containing input fragments, or attach the last user message to a crash report. Each of those is a transmission, and each defeats the claim if the claim was made absolutely. Describe the fallback in the notice rather than describing the happy path.
A Release Gate Worth Adding
Mobile compliance drifts because the app ships every two weeks and the privacy review happens annually. The fix is not a bigger review; it is a small gate attached to the thing that changes. Four questions, answered in the pull request that introduces a new data flow:
- Does this release contact a domain the previous release did not?
- Does it collect a data category not already in the privacy label and policy?
- Is the recipient covered by service provider terms, and is it on the subprocessor list?
- Does the deletion routine reach whatever this feature stores?
Three of the four are answerable from the diff and the proxy run. The fourth is a contract question that legal answers once per vendor. That is a gate a mobile team will actually keep, which is the only kind worth writing.
Frequently Asked Questions
Does CCPA apply differently to a mobile app than to a website?
The statute does not distinguish by channel — a consumer is a consumer whether they arrive through a browser or a binary. What differs is every mechanism the compliance industry built, because those were built for the web. Consent banners, opt-out link placement, cookie inventories and Global Privacy Control all assume a browser. An app has none of that infrastructure, so obligations that are satisfied automatically on the website have to be implemented deliberately in the app.
Is sending prompt text to an AI vendor a sale or a share?
It depends on the contract, not the technology. Under CCPA, disclosure to a vendor bound by service provider terms — processing only for your specified purposes, no retention for its own use, no combining with other data — is not a sale or a share. The same transfer to a vendor without those terms, or to one that reserves the right to train on your users' inputs, looks much more like one. The distinguishing fact sits in the agreement you signed, which is why the AI vendor's default terms are a privacy decision.
Does Global Privacy Control apply inside an app?
GPC as specified is a browser signal, and there is no equivalent that a native app automatically receives. That does not remove the underlying duty to offer an opt-out from sale and sharing; it removes the automatic mechanism. In practice this means a real in-app control that changes SDK behaviour, plus, if your app renders any content in an embedded web view, respecting the signal in that surface. A privacy setting that toggles a flag nothing reads is worse than none, because it is a representation to the user.
How do app store privacy labels interact with CCPA?
They are platform requirements rather than statutory ones, but they are public statements about your data practices that a regulator or plaintiff can compare against reality and against your privacy policy. The common failure is drift: a label completed at launch, an AI feature added in a later release that sends new categories to a new vendor, and nobody reopens the questionnaire. The label then understates collection, and the mismatch is trivially observable from outside your company.
Do we need a notice at collection inside the app?
Yes, and it has to be at or before the point of collection, which for an AI feature is usually the first time the user opens it rather than the app's first launch. A privacy policy reachable through a settings menu three screens away is not a notice at collection. The workable pattern is a short in-context disclosure the first time the feature is used, naming what is sent and whether it leaves the device, with a link to the full policy.
Does on-device inference remove the problem?
It removes most of it, which is the strongest argument for on-device processing that has nothing to do with latency. If the content never leaves the handset there is no disclosure to a third party, no sale-or-share analysis, and no subprocessor to add. The care point is that few features are purely on-device: telemetry about usage, error reports containing input fragments, and fallback paths to a cloud model when the local one fails all reintroduce transmission. Verify the fallback, not the intent.
What happens to AI conversation history in a deletion request?
It has to be included, and it is routinely missed because it lives outside the primary database. Conversation logs may sit with the AI vendor, in an analytics SDK's payloads, in crash reports, and in whatever store powers the feature's own history view. A deletion process that clears the user record and leaves the transcripts is incomplete, and the transcripts are usually the most sensitive artefact the app holds.
Which categories does an in-app AI assistant usually add?
More than teams expect, because the user decides what to type. An assistant that was scoped for product questions receives health details, financial specifics and information about third parties, none of which appears in your data map. Some of those fall into sensitive personal information with its own limitation rights. The honest way to categorise free-text input is by what users actually send, sampled from real usage, rather than by the feature's intended purpose.
Run the Proxy Test First
Before rewriting the policy, put the current build behind a proxy and capture the domains it contacts while a user exercises the AI feature — once with the opt-out off, once with it on. That single comparison answers whether your recipient list is accurate and whether your opt-out changes any behaviour.
Everything else in this article is downstream of those two lists. Written policy that contradicts observed traffic is the finding a regulator can make without asking you anything.