Data protection by platform:The role of private actors in shaping GDPR compliance in the mobile ecosystem

Mobile tracking has far-reaching implications for privacy. In the European Union (EU), although the General Data Protection Regulation (GDPR) is intended to establish a baseline level of data protection, unlawful data processing through mobile applications remains widespread. This dissertation examines how mobile app stores and mobile operating system providers influence the GDPR compliance of mobile applications, and to what extent this role is currently addressed within EU data protection law frameworks. While app stores, given their intermediary position and market power, appear well suited to support GDPR compliance, this dissertation identifies substantial limitations in the current approaches adopted by both Apple and Google to address mobile tracking. In particular, this dissertation critically examines the tools and governance mechanisms that Apple and Google implement in the mobile ecosystem to limit tracking practices, and identifies significant discrepancies between their design and implementation on the one hand, and the requirements and underlying principles of the GDPR on the other.