Viewer privacy considerations and privacy compliance
The Experiences solution consists of an SDK embedded in your app and a backend that serves content to viewers via the SDK.
The SDK is privacy-first. Your app supplies a viewer ID for each logged-in viewer, typically a UUID from your own account system. Only you hold the mapping from that ID to the person. WSC Sports receives the ID and related interaction events, not names, emails, or other direct identifiers, and can't resolve the ID back to an individual. It uses this data for recommendations, personalization, analytics, and backend operations.
Ask your developers to meet the Viewer ID specifications.
A note from our legal team: Nothing in this documentation is meant to be legal or compliance advice. You should work closely with legal and other professional advisors to determine exactly how privacy laws and frameworks, such as GDPR, CCPA, or ePrivacy, may or may not apply to you.
Privacy principles
- The SDK doesn't collect personally identifiable information (PII) such as names, email addresses, or phone numbers.
- It may collect general metadata (device type, approximate location). The approximate location is derived from the viewer's public IP address by default.
- You supply a viewer ID, typically a UUID, to enable recommendations, personalization, analytics, and content delivery. See Viewer ID specifications.
Tracking modes
Tracking modes ensure that no events are forwarded to the WSC Sports platform without your explicit consent. They determine how and when the SDK sends events.
For clarity, tracking modes don't affect event delivery between the SDK and your app, which happens locally on the viewer’s device. You control how these events are used and whether they're communicated to your backend systems.
The table below shows the available tracking options, how they affect features, the SDK APIs needed to implement each mode, and the impact on viewer consent requirements.
Do not track strips the viewer ID from analytics events before they're sent, and replaces the SDK's own generated user ID with a fixed placeholder so the events can't identify the app installation either. With tracking disabled, no analytics events are collected at all. Neither setting clears a stored viewer ID on its own.
You own viewer identity in the SDK. When a viewer should be anonymous or logged out, clear the viewer ID yourself. Turning on do not track or disabling analytics is not enough. Leaving the ID set can still sync activity across devices and keep personalization tied to that account. The Anonymous and No tracking rows in the table below assume you also cleared the viewer ID.
Set do not track from your own app's consent state, not from Apple's App Tracking Transparency (ATT) status. ATT doesn't apply to the Experiences SDK's viewer ID. See Does Apple's App Tracking Transparency prompt apply to the Experiences SDK? and the iOS doNotTrackUser parameter in iOS methods.
| Characteristic | Identified (default) | Anonymous | No tracking (tracking disabled) |
|---|---|---|---|
| SDK API1 | Set viewer ID (externalUserId) | Turn on do not track and clear the viewer ID | Disable analytics and clear the viewer ID |
| Cross-device sync | Full | Local only | Local only |
| Send analytics events to WSC Sports | Full | Session-based | None |
| Personalization | Full | Session-only | None |
| Content delivery | Supported | Supported | Supported |
| Consent required | Yes (Performance & Analytics)2 | Yes (Performance & Analytics)2 | No (Strictly necessary)2 |
| IP address | Retained | Known only for the duration of the session | Known only for the duration of the session |
1 Viewer ID mustn't include PII. See Viewer ID specifications. API names differ by platform: iOS: setExternalUserId, doNotTrackUser, disableAnalytics. Android: setExternalUserId, setDoNotTrack, disableAnalytics. Web: setExternalUserId, setDoNotTrack, setDisableAnalytics. React Native: setExternalUserId, setDoNotTrack, setDisableAnalytics. API reference: iOS | Android | Web | React Native.
2 Consent classification: Disabled = strictly necessary (no consent required); Identified/Anonymous = Performance & Analytics (user consent required under GDPR/ePrivacy).
Updated 16 days ago