21 August 2025 · Engineering
Why SDK size matters for privacy
Privacy reviews look at purposes and lawful bases. Users look at install size, battery, and whether the app feels watched. A telemetry SDK that quietly adds a megabyte and a dozen background jobs fails both audiences.
We measure SDK size in critique because extra kilobytes are usually extra code paths, and extra code paths are usually extra fields. Vendor “lite” packages still pull in device graphs if you leave default plugins on. Privacy-First App Analytics treats binary size as a proxy for curiosity you have not yet justified.
What a fat SDK tends to collect
Automatic screen tracking, gesture breadcrumbs, network traces “for performance”, and advertising identifiers “just in case growth asks”. Each plugin has a slide explaining itself. Together they recreate a person. The dictionary exercise in Privacy-First Mobile Telemetry often starts by disabling plugins until the payload matches the purpose map.
Battery and consent are related
Users who notice drain disable analytics at the OS level or uninstall. Your carefully worded in-app banner never gets a chance. A smaller, quieter SDK that only runs after consent and only uploads a daily summary is more likely to remain on. That is a product outcome, not only a legal one.
We ask learners to report three numbers with their final artefact: download size delta, background wake-ups per day in a test build, and count of properties leaving the device. If any number rose during the studio, we ask why.
Do not confuse small with kind
A tiny SDK that ships a permanent install ID is worse than a slightly larger one that only sends aggregates. Size is a signal, not a certificate. Pair it with the necessity test on our approach page.
If you are choosing a vendor this quarter, ask for a build with plugins off and a packet capture from a fresh install. Read the capture before you read the marketing site.