1. Missing or Incomplete Data Processing Agreement (DPA)
The mistake: Deploying Branch without a signed DPA, or assuming Branch's generic privacy policy satisfies GDPR Article 28 obligations.
Why it happens: Many founders treat Branch as a simple analytics tool and don't realize that device fingerprinting and identifier collection make them a processor relationship, not a service provider. The standard Branch privacy policy is not a DPA.
Consequence: Direct GDPR non-compliance. Regulators treat missing DPAs as one of the first red flags in audits. Fines under GDPR Article 83 can reach 4% of global revenue. Additionally, you may face liability if Branch suffers a breach and you cannot demonstrate a contractual processor relationship.
2. Collecting IDFA or GAID Without Explicit Consent
The mistake: Initializing Branch on iOS without implementing Apple's ATT prompt, or not requesting Android's advertising ID consent under applicable frameworks (e.g., Google Play policies).
Why it happens: Developers often assume Branch "handles" this or that user-level OS permissions are sufficient. ATT is not an OS permission; it is a separate consent requirement for identifier use.
Consequence: App rejection or removal from the App Store, and violation of Google Play developer policies. GDPR also applies: IDFA/GAID is personal data; without consent (ATT on iOS), collection breaches GDPR Article 6(1)(a).
3. Ambiguous or Missing Privacy Policy Disclosure
The mistake: Listing Branch as "third-party analytics" without naming it specifically or explaining that it collects device fingerprints and install attribution data (not just session analytics).
Why it happens: Founders rely on boilerplate "analytics" language and don't review what Branch actually collects. Device fingerprinting is not commonly discussed in generic privacy policies.
Consequence: GDPR Article 13/14 violation (lack of transparency). Regulators and users cannot identify what Branch does. If a user exercises GDPR Article 17 (right to erasure) or CCPA Section 1798.105 (deletion), you cannot efficiently instruct Branch what to delete because your disclosure was vague.
