Bangphlat teams often discover the problem with a simple trace: install a clean build, deny all prompts, then open the app’s sandbox. Vendor folders appear anyway. Files contain device graphs, session IDs, or advertising identifiers collected “for later.” Later is still processing.
PDPA asks what purpose you stated, what basis you rely on, and how long you keep the data. An SDK default of “26 months, US region” is not a purpose limitation. If you are the Thai controller, the vendor’s DPA does not write your record of processing for you.
Boot as a processing moment
Initialisation can include: reading the advertising identifier, creating a UUID, opening a SQLite queue, registering lifecycle callbacks, and scheduling an upload. Each of those can be personal-data processing even if no event name looks marketing-like.
Consent-aware app analytics therefore treats boot as a designed state machine. State A: process alive, no durable analytics. State B: basis recorded for diagnostics only. State C: basis recorded for product measurement. State D: revoke in progress. Most commercial SDKs collapse A–C into a single init(). Your wrapper must uncollapse them.
Legitimate interest is not a blank cheque
Some diagnostic signals may rest on a documented legitimate interest or on security. That memo should be specific: crash stacks without identifiers, fraud holds, not “all product funnels because we like funnels.” PDPA Measurement Studio spends a week writing those memos in language counsel will actually keep.
Cross-border collectors remain common. Name the processor, the country, and the deletion SLA. EU-style clauses help some transfers; they do not automatically satisfy a Thai purpose or retention clock. If you cannot delete on revoke because the vendor has no API, that is a procurement issue, not a dashboard issue.
A practical check
Before the next release, run the app with all prompts denied and list every new file and every HTTPS host. If analytics hosts appear, you do not yet have a PDPA-aligned boot. The flagship Consent Architecture week one is exactly this inventory, using anonymised Thai consumer builds.
Related: deny-by-default layer and the practice page.