Pitfall 1: Treating IP address collection as "not personal data"
The mistake: Teams often deploy Google Maps SDK without updating privacy policies, assuming IP address is too vague to require disclosure. This is incorrect under GDPR Article 4(1) and CCPA Section 1798.100—IP address *is* personal data when linked to a user's device or account.
Why it happens: Google Maps SDK's IP collection is automatic and invisible; many founders don't realize it occurs unless they inspect network requests. Google's own documentation doesn't prominently flag this.
Consequence: DPAs can issue fines under GDPR Article 83 for processing without lawful basis. CCPA violations trigger statutory damages of $100–$750 per consumer, per incident. California Attorney General has prioritized location-based enforcement.
Pitfall 2: Missing DPA with Google LLC
The mistake: Deploying Google Maps SDK in EEA without a signed Data Processing Agreement (DPA). Google's standard terms do not constitute a valid DPA under GDPR Article 28(3).
Why it happens: Indie teams assume Google's terms are sufficient, or don't realize they must execute a separate DPA document. Google does provide one, but it must be signed before data flows.
Consequence: GDPR Article 28(4) violation—the controller is liable if a processor lacks a DPA. Recent enforcement (e.g., Meta/Ireland DPC) shows regulators issue large fines for this specific gap. Your app cannot legally operate in the EEA without a signed DPA.
Pitfall 3: Conflating "location permission" with "consent for Google Maps SDK data sharing"
The mistake: Relying only on the device OS location permission prompt (iOS/Android) to satisfy GDPR/CCPA consent for location data transfer to Google.
Why it happens: App developers often assume the OS-level permission is sufficient, because the user is granting "location access to the app."
Consequence: The OS permission grants location *to your app*, not explicit consent to Google Maps SDK's data processing. Under GDPR Article 7, you must separately obtain clear, affirmative consent to the third-party processing. CCPA also requires explicit opt-in for location data sale. Missing this means non-compliance even if users grant OS permissions. DPAs treat this as a consent violation.
