Mobile app consent goes wrong because the operating system already shows prompts, and they look like consent. A permission dialog grants an app technical access to a capability. Consent under a data protection regime is a freely given, specific, informed and unambiguous agreement to a purpose. The same tap can satisfy one and not the other, and the gap between them is where most app privacy problems live.
What a permission prompt actually decides
It decides whether the app may reach the camera, the microphone, the photo library, the contacts or the location, and it is written by the platform in the platform's words. It says nothing about what you will do with what you collect, who you will share it with, or for how long you will keep it. A user granting location so a delivery app can find their address has not agreed to their movements being used to build an advertising profile, and no reading of the prompt says they have.
The two things to ask separately
First, a purpose string that explains why the permission is wanted, in your words, before the platform prompt appears. Both platforms require a usage description and both reject apps whose strings are vague, and a specific one materially raises the grant rate anyway. Second, where a purpose needs consent under a data protection regime, a real in-app consent step: a named purpose, an affirmative action, a record of what was shown and when. Tracking across apps and sites is the clearest case, and both platforms also gate it with their own control.
What to record
For each consent: the person or device identifier, the purpose in words, the version of the wording shown, the timestamp and the app version. For each permission: the grant state at the time of collection, because a user can revoke it in settings and your logs should not imply you had access you did not. Withdrawal has to be as easy as granting was, which in an app means a settings screen with the same choices rather than an email address.
Questions people ask about mobile app consent
Does granting location permission mean we can share location data?
No. The permission is technical access. Sharing for a purpose the user was not told about needs its own basis, and for advertising purposes that generally means consent and, in California, an opt-out route.
Is the app store's tracking prompt enough?
It is a platform requirement with its own consequences, not a data protection consent. Where the regulation requires consent, you need your own record of what was agreed.
What about apps for children?
That is a separate regime with verifiable parental consent requirements and limits on what may be collected at all, and it needs specific advice rather than a general consent flow.