AI App With Database

Data privacy basics for small apps: what you must tell users (GDPR, CCPA)

What GDPR and California’s CCPA require a small app to tell its users, when each law applies, the deadlines for answering requests, and a practical checklist for your privacy notice.

Floot ·

Key Takeaways

  • GDPR has no small-business exemption for scope. Under Article 3, it can apply to a business outside the EU that offers goods or services to people in the EU, whether or not they pay.
  • CCPA has size thresholds. It applies to for-profit businesses doing business in California that meet one of three tests, the first being annual gross revenue above $26,625,000 as adjusted from January 1, 2025.
  • Tell people at the moment you collect. GDPR Article 13 requires specific information “at the time when personal data are obtained.” CCPA requires a notice at or before collection.
  • Requests have deadlines. GDPR: one month, extendable by two months. CCPA: 45 calendar days for requests to know, delete or correct, extendable to 90.
  • Collect less and you have less to explain. Every field you don’t collect is one you don’t have to justify, protect, export or delete.

Quick-Start Prioritization Framework

QuestionGDPR (EU)CCPA (California)
Who it protectsPeople in the EUCalifornia residents
Does it cover tiny businesses?Can, if you offer goods or services to people in the EUOnly if a threshold is met
Notice requiredArticle 13 information at collectionNotice at collection plus a privacy policy
Request deadlineOne month (plus up to two more)45 days (plus up to 45 more)
Breach reportingTo the authority within 72 hours where feasibleSeparate California breach law applies

As soon as your app stores a name, an email address or a login, it holds personal data, and privacy law starts to apply. For most small apps the two laws people ask about are the EU’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA). They work differently: GDPR can reach very small businesses that serve people in the EU, while CCPA applies only to businesses above certain size thresholds. This guide explains when each applies, what you must tell users, and how to handle their requests. It is general information, not legal advice; for your specific situation, talk to a privacy lawyer.

What counts as personal data in a small app

Personal data is broader than most people assume. In a typical small business app it includes names, email addresses, phone numbers, delivery addresses, login records, IP addresses in logs, uploaded photos, messages and order history tied to a person.

Make a data inventory first

Before writing any notice, list every table and every third-party service that touches personal data. For each, write what is stored, why, who can see it, and how long you keep it. This one page becomes the backbone of your privacy notice and answers half of any user request.

Don’t forget the services behind the app

Your hosting provider, email sender, payment processor and analytics tool all process personal data on your behalf. Under GDPR, these are processors, and Article 28 requires a binding contract with them setting out how they handle the data. Most reputable providers publish a data processing agreement you can accept.

When GDPR applies to you

GDPR applies to businesses established in the EU, and Article 3(2) extends it to businesses outside the EU when they process data of people in the EU in connection with “the offering of goods or services,” whether or not payment is required, or with monitoring their behavior in the EU.

What “offering” means in practice

A US bakery whose app happens to have one sign-up from Spain is in a different position from a US software business that markets in euros and ships to France. Signs that you are targeting EU users include EU languages, EU currencies and EU shipping. If you are unsure, it’s a question for a lawyer, and treating GDPR as the baseline is a common cautious approach.

You need a lawful basis

GDPR requires a legal reason for each use of personal data. For a small app the common ones are that you need the data to provide the service the user signed up for, that the user consented (for example to marketing emails), or a legitimate interest you can explain. Your notice must say which one applies to each purpose.

What GDPR says you must tell users

Article 13 lists what you must provide when you collect data directly from someone, such as at sign-up. In plain terms:

  • Who you are and how to contact you, plus your data protection officer if you have one.
  • What you use the data for and the legal basis for each purpose.
  • Your legitimate interests, if that is a basis you rely on.
  • Who receives the data, by name or category (hosting, email, payments).
  • Whether data goes outside the EU, and the safeguards used.
  • How long you keep it, or how you decide.
  • Users’ rights: access, correction, erasure, restriction, objection and data portability.
  • The right to withdraw consent, where you rely on consent.
  • The right to complain to a data protection authority.
  • Whether providing the data is required and what happens if they don’t.
  • Any automated decision-making that significantly affects them.

Timing and placement

The information must be available at the time of collection. A link to your privacy notice next to the sign-up button, and on any form that collects personal data, is the usual way to meet this.

When CCPA applies to you

California’s Attorney General explains that the CCPA applies to for-profit businesses that do business in California and meet any one of three tests. The revenue figure is adjusted for inflation; the California Privacy Protection Agency set it at $26,625,000 from January 1, 2025.

TestThreshold
Annual gross revenueAbove $26,625,000 (adjusted from $25 million, effective January 1, 2025)
Personal information volumeBuys, sells or shares personal information of 100,000 or more California residents or households
Revenue from selling data50% or more of annual revenue from selling or sharing California residents’ personal information

Most small apps fall below the thresholds

A local service business with a booking app typically meets none of these tests. But other US states have passed their own privacy laws with different thresholds, and customers increasingly expect the same rights everywhere. Many small businesses therefore offer access and deletion to everyone, which is simpler than checking where each user lives.

What CCPA says you must tell users

For businesses it covers, the Attorney General’s guidance describes three main disclosures.

Notice at collection

At or before collecting personal information, list the categories you collect and what you use them for, and link to your privacy policy.

Privacy policy

A written description of your collection, use, sharing and sale practices, and how consumers can exercise their rights: to know, delete, correct, opt out of sale or sharing, limit use of sensitive information, and not be discriminated against for using these rights.

Do Not Sell or Share link

If you sell or share personal information, you need a clear “Do Not Sell or Share My Personal Information” link, and you can’t require an account to opt out. Opt-outs must be honored no later than 15 business days after receipt.

Handling user requests: access, export and deletion

Both laws give people the right to ask what you hold and to have it deleted. Plan how you’ll do this before the first request arrives.

GDPRCCPA
Deadline to respondWithout undue delay, within one month45 calendar days
ExtensionUp to two further months, telling the person within the first monthAnother 45 days (90 total), with notice
Typical requestsAccess, correction, erasure, portability, objectionKnow, delete, correct, opt out, limit

Make it possible in your app

Practically, you need a way to find everything about one person across your tables, export it in a readable format, and delete or anonymize it. If your database links everything to a user or customer ID, this is a few queries. If personal details are scattered in free-text notes, it’s a manual search.

Deletion and records you must keep

Erasure isn’t absolute. You may need to keep invoices for tax purposes. A common approach is to remove or anonymize the personal details and keep the financial record. Document what you keep and why.

Verify the requester

Before sending someone’s data, confirm the request comes from them, for example by requiring it to come from the account’s signed-in user or its verified email address.

Security and breaches

Both laws expect reasonable security. For a small app that means unique logins with permissions, encrypted connections (HTTPS), limited staff access, backups, and removing data you no longer need.

The GDPR 72-hour rule

Under Article 33, if a breach is likely to pose a risk to people, you must notify your supervisory authority without undue delay and, where feasible, “not later than 72 hours after having become aware of it.” Know in advance who would make that call and how.

Common mistakes

These are the privacy gaps small apps most often have.

Copying another company’s privacy policy

It will describe services and practices you don’t have and miss the ones you do. Write from your own data inventory.

Collecting “just in case”

Date of birth, home address and phone number for an app that only needs an email increase your obligations and risk for no benefit.

No way to delete an account

If deletion requires a developer, requests will be slow and error-prone. Plan it as a feature.

Forgetting logs, backups and third parties

Personal data also lives in email tools, analytics and backups. Your notice and your deletion process need to cover them.

If you build your app with an AI app builder

If you’d rather not build the data plumbing yourself, you can describe an account deletion flow and a personal-data export to an AI app builder such as Floot and have it build them into your app, and Floot lets you download an app’s full database on every plan. The legal decisions, such as your lawful basis and what your notice says, remain yours.

Frequently Asked Questions

Does GDPR apply to a small US business?

It can. Article 3(2) applies GDPR to businesses outside the EU that offer goods or services to people in the EU, paid or free, or monitor their behavior there. A lawyer can tell you whether your activity counts as offering to the EU.

Does CCPA apply to my small business?

Only if you are a for-profit doing business in California and meet one of three tests: annual gross revenue above $26,625,000 (as adjusted from January 1, 2025), buying, selling or sharing personal information of 100,000 or more California consumers or households, or earning half your revenue from selling or sharing it.

Does a small app need a privacy policy?

If it collects personal data from people in the EU, GDPR requires the Article 13 information, which is usually provided in a privacy notice. Covered businesses need one under CCPA. App stores and payment providers also commonly require one. In practice, nearly every app that stores user data should have one.

How quickly must I respond to a data deletion request?

Under GDPR, within one month, extendable by two further months for complex requests if you tell the person within the first month. Under CCPA, within 45 calendar days, extendable once by another 45 days with notice.

Is an email address personal data?

Yes. An email address identifies a person, so it is personal data under GDPR and personal information under CCPA, even if it is all you collect.

Do I need a data processing agreement with my hosting provider?

Under GDPR, Article 28 requires a binding contract with any processor that handles personal data for you. Most hosting, email and payment providers offer a standard data processing agreement.

Sources