The first mistake is theatre: a banner that says ‘we care about privacy’ while the warehouse keeps click streams for a period nobody can justify. In the United Kingdom, UK GDPR still expects purpose, minimisation, and a retention story you can speak. ‘We might need it for a dashboard’ is not a purpose. It is a mood.
The second mistake is treating lawful basis as a sticker. Legitimate interests assessments, where they are used, have to survive a conversation with a person who does not work in product. If you cannot explain why a replay of a failed checkout is necessary, do not collect it ‘just in case the sitting needs colour’.
Account closed, tracker still warm
We keep seeing identifiers that persist after the user has asked the app to forget them. Sometimes it is a device ID the vendor treats as immortal. Sometimes it is a ‘deleted_user’ row that still joins to campaign tables. The Cohort Atlas includes a cut we would rather not need: ‘still in analytics after account closure’. If that set is not empty, the chart is not only a product problem.
International transfers sit in our privacy notice because some studio tools and some student vendors send data outside the UK. Name the transfer. Do not hide it behind a logo strip. If a sitting requires a screenshot, crop chrome that reveals other customers, and do not paste exports into a group chat.
None of this makes App Analytics impossible. It makes the grain of the event list a legal artefact as well as a product one. That is why taxonomy week happens before praise. If you need counsel in the room for your own stack, say so when you write to the desk.