01
Deny by default
Wrappers default to off. Feature flags that “enable analytics in debug” must not ship in release. Pre-install OEM kits are inventoried like any other vendor.
Practice
Consent-aware app analytics is an architecture, not a toggle.
This page is the studio’s working definition. If you only need a syllabus, start with courses. If you need the idea before the timetable, stay here.
The gate sits before enqueue.
A banner that says “we care about privacy” while app_open already sits in a local queue is not consent-aware. The first design question is: what is allowed to exist in memory, on disk, and on the wire before a basis is recorded?
Our practice treats the analytics SDK as a guest. It is invited after the CMP (or a documented legitimate-interest memo) returns. Crash breadcrumbs may be held without identifiers; product funnels wait. That split is the beginning of consent-aware app analytics, not the end.
02
Revoke is a feature
Every property has a deletion or stop-processing path. Dashboards are allowed to go sparse. Completeness is not a reason to keep a row.
03
Law is local
Thailand PDPA, store policies, and ATT strings are read together. A US vendor default of 26-month retention is not a Thai purpose limitation.
What we refuse to call analytics
Device fingerprinting dressed as “anonymous quality,” silent IDFA fallbacks, and server-side stitching that ignores a CMP reject are outside this practice. We will discuss them in class as anti-patterns, not as advanced tips.
If your growth model depends on reconstructing a person who declined, Sensor Linkhub is the wrong studio. If you need measurement that remains useful at 40% opt-in, you are in the right room.
Where to go next
The flagship, Consent Architecture for Mobile Analytics, spends eleven weeks on the wrapper, the CMP bridge, and the revoke drill. Shorter benches cover fingerprints, PDPA boot, and CMP fan-out alone. Questions that are not a syllabus fit can go to the Bangphlat desk.