Data protection basics for app founders: GDPR and CCPA
A plain-words overview of GDPR and CCPA for people launching an app: when they may apply, what they usually ask of you, and the practical steps to start with.
Leer en español →
If your app collects personal data (names, emails, locations, payment details, messages), privacy laws such as the EU's GDPR and California's CCPA may apply to you, sometimes even if your company is based elsewhere. In practice they ask for the same core things: know what data you collect and why, collect only what you need, tell people clearly in a privacy policy, let them access and delete their data, protect it, have proper contracts with the services that process it for you, and act quickly if it leaks. This is a plain-language overview, not legal advice. Check your specific situation with a lawyer.
This guide explains when each law may apply, what they usually require, how that maps onto a typical app built with AI tools, and a short list of first steps.
Does GDPR apply to my app?
The General Data Protection Regulation is the EU's main privacy law. It can apply to you in two broad situations:
- Your business is established in the EU (or the wider European Economic Area).
- You are outside the EU but offer goods or services to people in the EU, or monitor their behaviour there (for example, tracking how they use your app).
So a US or Latin American startup with EU users may well be covered. Size doesn't exempt you, although some obligations are lighter for small organizations. The UK has its own, very similar version. The full text is on EUR-Lex.
Does the CCPA apply to my app?
The California Consumer Privacy Act (as amended by the CPRA) applies to for-profit businesses that do business in California and meet at least one threshold. According to the California Privacy Protection Agency, from January 2025 those are:
- Annual gross revenue above $26,625,000 (the figure is adjusted for inflation every two years).
- Buying, selling or sharing the personal information of 100,000 or more California consumers or households a year.
- Making at least half of annual revenue from selling or sharing personal information.
Many early-stage startups are below all three. That doesn't mean "no rules": other US states have their own privacy laws with different thresholds, and app stores, payment providers and business customers will ask about your data practices anyway. Check current details with the CPPA and your lawyer.
What do these laws usually ask of you?
The details differ, but the themes overlap a lot.
| Theme | What it means in practice |
|---|---|
| Know your data | A list of what personal data you collect, where it is stored and why |
| A reason for each use | Under GDPR, a legal basis such as contract, consent or legitimate interest |
| Collect less | Don't ask for or keep data you don't need |
| Be transparent | A privacy policy in plain language, linked at sign-up |
| People's rights | Access, correction, deletion and, in some cases, a copy of their data or opting out of "sale" or "sharing" |
| Security | Reasonable protection for the data you hold |
| Vendors | Contracts (often a data processing agreement) with services that handle data for you |
| Breaches | Assess quickly and notify when required. GDPR sets 72 hours for notifying the authority, where feasible, for breaches that pose a risk to people |
Response times for requests differ: under GDPR, generally one month; under the CCPA, generally 45 days. Both can be extended in some cases.
How does this map onto an app built with AI tools?
A typical Lovable, Bolt or Cursor app sends personal data to several services at once. Each one is part of your data story:
- Database and auth (Supabase, Firebase): your users' accounts and everything they create. Where is the project's region?
- Payments (Stripe): billing details, handled mostly by the provider.
- Email (Resend, SendGrid, SMTP): addresses and message content.
- Analytics and session recording: often the most invasive part, and in the EU usually subject to cookie consent rules. Our guide to analytics in your web app covers privacy-friendly setups.
- AI providers: if user text, files or images go to an AI model, check the provider's terms on data retention and training, mention it in your privacy policy, and avoid sending more than the feature needs.
- Error tracking and logs: these quietly collect emails, IDs and sometimes whole request bodies.
The biggest practical risk is usually not paperwork but security: data one user can read from another account, or a database open to anyone. Our guide on a user seeing another user's data is the place to start if you haven't checked.
What are the first steps I can take this week?
- Write a one-page data map. For each kind of personal data: what it is, why you collect it, where it lives (which service, which region), who can access it, and how long you keep it.
- Delete what you don't need. Unused profile fields, old test exports, debug logs with full request bodies.
- List your vendors and find each one's data processing agreement (most offer one in their dashboard or legal pages).
- Publish an honest privacy policy that matches the data map. A generic template that lists data you don't collect, or misses data you do, is worse than useless.
- Make deletion and export possible. Even a manual process ("email us, we'll handle it within the deadline") is a start, as long as you can actually do it across every service.
- Lock down access. Database rules, admin accounts with two-factor, no shared logins. See securing your admin panel.
- Write down what you'd do in a breach: who decides, who you'd call, how you'd contact users. You don't want to invent that under a 72-hour clock.
Quick answers
Do I need a privacy policy if I'm small? Practically, yes. App stores, payment providers and many laws expect one, and it forces you to know what you collect.
Is a cookie banner enough for GDPR? No. Consent for trackers is one piece. The rest (rights, security, vendors, breach handling) still applies.
Can I use user data to improve my AI features? Only if your privacy policy and legal basis cover it, and the provider's terms allow what you intend. Ask a lawyer before you do it.
Does using Supabase or Stripe make me compliant? No. They give you tools and contracts, but how you configure them and what you collect are your responsibility.
Who owns the code and data in my AI-built app? That's a related but separate question. See our overview of who owns code made with AI.
Where can I get help with the technical side?
We are not lawyers and can't tell you which laws apply. What we can do is the technical part: the free health check shows what your app exposes from outside, and our Supabase security review checks access rules, keys and data exposure in the code. For anything else, get in touch.
