GDPR EU representative for Android apps: who needs one in 2026

Who can serve as the representative, what Google's 2027 trader rules change, where the representative is named and what a missing appointment costs.

Google Play developers based outside the European Union must designate a representative in the EU under Article 27 of the GDPR once their Android app processes the personal data of people in the EU to whom it is offered or whose behaviour it monitors.

Why Google Play distribution brings the GDPR with it

Both tests come from Article 3 of the GDPR. On Google Play the first is settled in Play Console. A release available in EU countries, with a store listing translated into their languages and prices in local currency, targets those markets, and the GDPR itself names the language or currency of an EU country, combined with the ability to order in it, as signs of targeting.

Android apps meet the second test more often than their developers expect. The European Data Protection Board counts behavioural advertising, location data used for marketing, online tracking through cookies or techniques such as device fingerprinting, and personalised health or diet analytics as monitoring. An app whose Data safety section declares location, app activity or device identifiers shared for advertising or marketing describes exactly that. Collecting data online is not monitoring in itself: the board looks at the purpose and at the profiling that follows.

The exemption in Article 27 is narrow. It requires processing that is occasional, involves no large-scale sensitive data such as health or biometric data and is unlikely to create risks for people, all at once. An app with steady European traffic does not qualify.

Who can serve as your representative

Any individual or legal entity established in an EU country where your users live can take the role once appointed in writing. Law firms, consultancies and specialised companies offer it as a service, and an EU-registered company belonging to your own group qualifies as well. The European Data Protection Board recommends placing it in the member state where a large part of your audience lives.

The same guidance rules out two combinations: your representative cannot also act as your external data protection officer or process personal data on your behalf. An appointment in the United Kingdom does not count for the EU either: in 2025 Spain's data protection authority treated a company whose representative sat in Northern Ireland as having no EU representative at all.

What the representative does for you

Under the mandate, users and supervisory authorities can address the representative alongside the developer, or in its place, on any question about the processing. The representative also holds the record of processing activities, which the developer keeps up to date, produces it when an authority asks, cooperates with investigations and hands over the information an authority orders.

The appointment does not shield the developer: legal action against the company itself remains possible, and authorities may serve corrective orders and fines on the developer through the representative. The mandate should therefore name Article 27 of the GDPR and list these duties in plain terms. An authorised representative appointed under another EU law, for medical devices for example, does not cover data protection: Italy's data protection authority fined the maker of the Eversense glucose-monitoring app $51,000 (€45,000) in 2022 in a case that included exactly this mistake.

What Google Play publishes and the trader declaration

Google Play already shows every developer's legal name and email in the store profile. An organisation account also shows its legal address and phone number, and a personal account with paid apps or in-app purchases shows its full address. To open an organisation account, Google verifies the company's D-U-N-S number, legal name, address and phone.

A bigger change is under way. Every developer account worldwide must declare its trader status under the laws of the European Economic Area and the United Kingdom in Play Console by 1 February 2027, and new accounts make the declaration when they are created. From 1 March 2027 Google Play operates as an online marketplace in the EEA and the UK. Users everywhere will see a trader's contact details, its D-U-N-S number in the app support section and a link to its terms of service where it provides one, and in the EEA and the UK the developer's name replaces Google in the "Offered by" line. An account that misses the deadline faces enforcement, from blocked app updates to removal of its apps from Google Play worldwide. A false non-trader declaration breaches Google's Developer Distribution Agreement and can cost the account. A personal account that declares itself a trader must make its phone number and address public.

None of these details appoints anyone to answer for your data processing, so the trader declaration and an Article 27 representative are separate obligations. For developers who would rather not publish a home address, an app published by a company shows the company's details, as explained in our guide to a Google Play developer account for a company.

The privacy policy and the Data safety form

Google Play requires every app, even one that touches no personal data, to post a privacy policy both in the designated field in Play Console and inside the app. The policy must live at an active public address, without geoblocking and not as a PDF, and Google's User Data policy asks it to name the developer and a privacy point of contact. For a developer outside the EU, that contact block is where the GDPR expects the Article 27 representative: the representative's name, an EU postal address and a monitored email address. Play Console has no separate field for the representative, so what users see in the policy is what counts.

The Data safety form must match the privacy policy, including the data collected by every SDK in your build. Test the representative's mailbox before you publish it: a regulator's letter that lands in spam goes unanswered all the same.

Children's apps carry more risk

Under the GDPR, an online service that relies on consent needs a parent's consent before it processes the data of a child below the age of digital consent. The age is 16 unless an EU country lowers it, and no country may set it below 13. Regular processing of children's data is neither occasional nor low-risk, so the Article 27 exemption does not apply, and an app for children with users in Europe needs a representative from its first European install. We have set up such a representative for a children's app.

Apps with user content need a DSA representative too

An Android app that stores and displays what its users upload, from posts and photos to reviews, listings and shared files, counts as an intermediary service in the sense of the Digital Services Act. Since 17 February 2024 every such provider without an establishment in the EU has had to designate a legal representative, in writing, in a member state where it operates, whatever the size of the company. The act's recitals list availability in a national app store among the signs that a service is aimed at that country.

The provider notifies this representative's name and contacts to the Digital Services Coordinator in the representative's country and keeps them public, and the representative itself can answer for the provider's breaches. In August 2025 Malta's coordinator publicly demanded explanations from Kick, an Australian streaming platform, after it failed to notify its legal representative. A provider without a DSA representative can be supervised by every EU country at once, and fines can reach 6% of worldwide annual turnover. Regulators also use the act's notice procedure against apps directly: in June 2025 Berlin's data protection commissioner reported the DeepSeek app to Google and Apple as illegal content, citing transfers of personal data to China.

The United Kingdom needs a representative of its own

The United Kingdom keeps its own version of the GDPR. Article 27 of the UK GDPR survived Brexit: a developer without a British establishment that targets users in the United Kingdom, or tracks their behaviour, must name a representative located there in writing. The exemption is as narrow as in the EU, and the fines mirror the EU ones. A representative in an EU country does not cover British users, so an app published in both markets needs two appointments.

Vulnerability reports under the Cyber Resilience Act

The Cyber Resilience Act also reaches Android apps made available in the EU in the course of a commercial activity, a test that free apps living on ads or in-app purchases meet as well. Since 11 September 2026 their makers have had to report actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours. The remaining obligations apply from 11 December 2027. A representative under this act is voluntary, unlike the GDPR one.

What a missing representative costs

The GDPR caps fines for a missing representative at $12 million (€10 million) or 2% of global annual turnover, whichever is greater. In 2022 Italy's authority fined Clubhouse $2.3 million (€2 million) for a series of breaches. Its privacy policy gave the representative's postal address without an email, and the representative's own page described it as a facilitator rather than a real counterpart. The company first argued that simply listing the app in the two big stores showed no intention to serve Italy, then stopped contesting the GDPR's reach, and the authority applied it. In the Netherlands, the data protection authority imposed $590,000 (€525,000) on Locatefamily.com for never naming a representative at all.

How Murblz handles representation for Android developers

We handle it end to end.

1. We check whether Article 27 applies: the countries in your releases, store listing languages, data types and the SDKs in your build.
2. We appoint your representative and draw up its written mandate.
3. We add the representative to your privacy policy and align the policy with your Data safety answers.
4. We draw up the record of processing activities and update it with each significant release.
5. We run the representative's mailbox and pass requests from users and authorities to you.
6. We also designate the legal representative the Digital Services Act requires for apps with user content, and we prepare your trader declaration in Play Console.
7. We can register an EU company of your own group to act as your representative.

FAQ