Article · June 17, 2026
What should apps note about Firebase Analytics under the PDPL?
Firebase Analytics for apps may trigger PDPL duties: consent, notice, evidence retention, and managing data sent to Google.
Quick answer
What does the PDPL mean for apps using Firebase Analytics?
The PDPL implications for an app using Firebase Analytics center on measuring user behavior, which leads to personal data processing under the Personal Data Protection Law. The key point isn’t merely “whether you use Firebase,” but what the app collects, what it sends to Google, and whether appropriate consent has been obtained.
In practice, Firebase Analytics may record data such as device identifiers, advertising IDs if related features are enabled, app-open events, viewed screens, session duration, crash errors, install source, or in-app interactions. When these data can be tied to a specific user or device, businesses should treat them as data flows that must be governed under the PDPL.
What data do apps send to Google via Firebase Analytics?
Firebase Analytics typically sends events and attributes related to app usage to Google’s infrastructure. For many apps, this isn’t merely simple anonymous statistics; it can include device identifiers, technical information, interaction timestamps, and detailed event data.
The crucial point is that data “leaves” your system to support measurement, analytics, or ad optimization. Under the rules, businesses need to determine their role, the recipient’s role, the purposes of processing, retention periods, and mechanisms to ensure users clearly understand that data is being transferred to a third party.
| Category | Example in Firebase Analytics | PDPL risks/ obligations | |
|---|---|---|---|
| Device identifiers | device ID, app instance ID, advertising ID | May be personal data or data linked to a user | |
| App events | app opens, button clicks, purchases, screen views | Must inform purposes and scope of processing | |
| Technical data | crash logs, OS version, device model | May be combined to identify a user/device | |
| Transfer to Google | analytics data sent outside your system | Must be transparent about recipient, purpose, and obtain appropriate consent |
Do apps need to obtain consent to use Firebase Analytics?
Yes. In many cases you should seek consent before enabling Firebase Analytics, especially when data may be used to analyze behavior, measure advertising, or when the app cannot demonstrate that this is minimal necessary processing under the rules.
Practically, do not enable analytics on the very first app open. Instead, show a clear consent banner/screen, allow users to accept or decline, and only activate the SDK after an appropriate choice is made. If the user declines, the app should disable non-essential measurement functions and record that state for consistent application.
Review SDKs and events:
list which events Firebase Analytics collects, and whether ads, A/B testing, or links to other Google services are enabled.
Classify data:
identify which data are device identifiers, behavioral data, technical data, and data that may be transferred abroad.
Design the consent screen:
present measurement purposes, the data recipient, accept/decline buttons, and a link to the privacy policy.
Block SDK before consent:
configure the app so analytics starts only after the user consents.
Retain evidence:
record the timestamp, version of the notice content, the user’s choice, and the associated device/session.
Allow withdrawal:
provide a way to change choices in-app and stop new collection when a user withdraws consent.
What should businesses do to use Firebase Analytics more safely under the PDPL?
Businesses should do five minimum tasks: create a data inventory, provide clear notices, seek consent before enabling the SDK, control data transfers to Google, and retain evidence of compliance.
A common implementation for SME apps in Vietnam includes: a consent screen on first open; a privacy policy describing Firebase Analytics; a toggle to enable/disable analytics in settings; and internal logs recording when the user gave consent. If the app also uses ads, attribution, or remote config tied to identifiers, assess each data flow separately.
A short content sample you can use in-app:
“We use Firebase Analytics to measure how you use the app, including app-open events, screen interactions, and technical data. Data may be sent to Google for analysis. You can accept or decline; if you decline, we will disable non-essential measurement features.”
What if the app has already been released?
If the app is live, don’t panic, but conduct a review immediately. Check whether the SDK collects data before consent, whether the privacy policy is accurate, and whether data is being sent to Google before the user makes a choice.
If you discover a data incident or mistakenly sent sensitive data, the business must assess the impact and file a data breach notice within 72 hours of discovery, as required. Serious violations may be subject to criminal handling; specific penalties will follow the Government’s guiding decree when issued.
The relevant enforcement authority is the Ministry of Public Security — Department of Cybersecurity and High-Tech Crime Prevention (A05). If you are preparing to launch an app, engage early with legal counsel to finalize the consent flow and compliance documentation.
- It’s usually advisable to obtain it first, especially if the app collects device identifiers or sends data to Google for analysis. A safe approach is to block the SDK until the user agrees.
- Commonly includes device ID, app instance ID, advertising ID, behavioral events, crash logs, and technical data that can be linked to a user or device.
- No. Typically you only need to disable non-essential measurement functions and let users use the app normally, unless a feature is strictly necessary for the service.
- Keep the consent content, acceptance time, policy version, SDK configuration, and evidence that analytics only runs after an appropriate user choice.
If you are working on a cookie banner, storing consent evidence, or a DSAR flow for an app, consent.vn can help standardize this so devs can implement it faster.
Source: the Personal Data Protection Law (Law 91/2025/QH15) (thuvienphapluat.vn); Decree 13/2023/ND-CP (thuvienphapluat.vn); A05 (bocongan.gov.vn)
Get started — no account needed.
Ready to comply with PDPL?