AppsFlyer, Adjust and the PDPL: what to do for mobile attribution

What is AppsFlyer, Adjust mobile attribution under the PDPL?

Short answer: this is a personal data compliance problem inside your app, not just a marketing measurement problem. When you install AppsFlyer, Adjust or similar SDKs, you typically trigger obligations under the rules on collecting, using, sharing, and potentially transferring personal data overseas.

In practice, attribution SDKs may process many signals such as advertising identifiers, device data, in-app events, IP, app open timestamps, install source, and sometimes behavioral/device recognition techniques to reconcile installs or conversions. Under the PDPL, the question isn’t just “which tool”, but:

• What data are being collected?
• Is it personal data or sensitive personal data?
• Have you provided notice and obtained consent properly in the app?
• Are you sharing it with any third parties beyond the attribution provider?
• Does any data leave Vietnam?

Do advertising IDs and fingerprinting trigger any obligations?

Short answer: they trigger duties of transparency, appropriate consent, and controlling data sharing according to the purposes disclosed.

For mobile attribution, two commonly overlooked points are:

1. Advertising identifier (advertising ID): commonly used to measure campaign performance, attribute installs, and remarket. If your app collects or transmits this identifier to AppsFlyer/Adjust, you need to check whether users have been clearly informed and whether there is an appropriate opt-out mechanism.

2. Fingerprinting: this is a technique to infer/match a device based on multiple signals such as IP, device model, OS, language, time, behavior, etc. Even if the purpose is attribution, for compliance you should treat this as a higher-risk form of processing because users find it hard to detect. The less transparent it is, the more you need to explain it in the privacy notice and obtain consent at the right time.

Note: don’t rush to label an SDK or tracker “illegal”. What you should do is identify the resulting obligations and design the consent flow, logging, retention, and vendor controls accordingly.

How should your app obtain user consent to use AppsFlyer, Adjust?

Short answer: obtain consent in the app before the SDK starts collecting data that is not essential to core operation, and make it clear enough for users to understand the measurement/advertising purposes.

A practical flow for Vietnam-based apps typically includes:

• A short notice screen before enabling marketing/attribution SDKs.
• Separate choices for advertising/measurement, not bundled with terms of use.
• A link to a full privacy notice stating that AppsFlyer/Adjust and relevant partners are recipients of the data.
• A mechanism to withdraw consent or turn off tracking in settings.
• Retention of consent evidence: time, notice version, consent status, device/app version.

Does AppsFlyer/Adjust mobile attribution under the PDPL involve cross-border data transfers?

Short answer: possibly, and this is the area that needs the closest scrutiny if the vendor, servers, or processing partners are outside Vietnam.

In a mobile attribution model, data may be sent from your app to the SDK, then to the provider’s infrastructure overseas, or further shared to other networks/partners. In that case, you need to consider obligations for cross-border transfers of personal data under current rules and related guidance.

In practice, you should check at least the following points:

• The vendor’s primary storage location.
• Whether any sub-processors are outside Vietnam.
• Whether data is transferred as raw events or has been pseudonymized/aggregated.
• Whether you have contractual mechanisms and data processing terms with the vendor.
• Whether you have impact assessments/internal policies for cross-border transfers as required.

If your app serves users in Vietnam but analytics/attribution is operated by a team in Singapore or the US, reconcile both the technical flows and the legal flows. This is where many SMEs “switch on the SDK quickly” without the corresponding governance records.

What should SMEs do right now?

Short answer: don’t start with paperwork; start with the data map and SDK configuration.

A lean, practical checklist:

• Draw the data flow for AppsFlyer/Adjust in your app.
• Identify which data fields are necessary and which are solely for marketing.
• Block marketing SDKs until consent is recorded, if your model requires consent.
• Check postback, deep link, raw data export, and audience sync configurations.
• Review contracts with vendors, agencies, and ad networks.
• Prepare mechanisms to respond to user requests for access, deletion, and withdrawal of consent.
• Establish incident response procedures; if a personal data breach is detected, notify within 72 hours of discovery as required.

A common mistake is thinking a web cookie banner is sufficient for an app. It’s not. Apps need their own consent mechanism because attribution SDKs work differently and may collect deeper signals from the device.

If you need a consent flow template or an SDK checklist for apps, consent.vn can help standardize your cookie banner, consent evidence logging, and DSAR workflows for your product/dev team.

Source: the Personal Data Protection Law (Law 91/2025/QH15) thuvienphapluat.vn; Decree 13/2023/ND-CP thuvienphapluat.vn; Ministry of Public Security (A05) bocongan.gov.vn