University attendance app tracking consent

Short answer

A university can introduce an attendance app, and it may lawfully process some device or location data through it, but only within the limits of UK data protection law. Any location tracking must be genuinely necessary and proportionate to the purpose of recording attendance, and cannot go further than that purpose reasonably requires. Whether the specific app your university is using is lawful depends on exactly what data it collects, how it collects it, and what legal basis the university relies on. A blanket requirement to install an app that continuously tracks your location, or that harvests device data unrelated to attendance, would be very difficult to justify.

The relevant law

The governing framework is the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Location data and device identifiers are personal data, and precise location data can be particularly sensitive. The key principles are in Article 5 UK GDPR, and the most important ones here are:

Lawfulness, fairness and transparency: the university must have a valid legal basis and must clearly tell you what it collects and why.

Purpose limitation: data collected for attendance must be used for attendance, not repurposed.

Data minimisation: the university may only collect what is adequate, relevant and limited to what is necessary. This is the principle most likely to be breached by an app that tracks continuous location or collects broad device data.

What legal basis a university typically relies on

Most universities do not rely on your consent for attendance monitoring. Instead they rely on Article 6(1)(e), performance of a task in the public interest (delivering higher education), or Article 6(1)(b), performance of the contract between you and the university, and sometimes Article 6(1)(c), a legal obligation. This matters, because if they rely on public task or contract rather than consent, you generally cannot simply refuse on the basis of withdrawing consent. The published privacy notices of several universities confirm this approach.

However, relying on public task or contract does not give the university a blank cheque. The processing must still be necessary and proportionate. Under the data minimisation principle, they must choose the least intrusive method that achieves the legitimate aim of recording who attended a teaching session.

Location data specifically

There is a real legal difference between an app that captures a single location check at the moment you check in to a class, and one that tracks your location continuously or in the background.

A momentary location check, used only to confirm you were near the room at the time of the session and then discarded or not stored, is far easier to justify as necessary and proportionate. Several universities operate exactly this model. Some (for example St Mary’s and Liverpool) explicitly state that you can decline location permissions, switch off GPS, and check in by an alternative route, and that the app is not designed to store map location data.

Continuous or background location tracking, or building a picture of your movements beyond confirming attendance, is much harder to justify and is likely to fall foul of data minimisation and proportionality. It is unlikely a university could lawfully require that simply to take a register.

Device data

If the app collects device identifiers, operating system information or similar purely to make the app function and to prevent fraudulent check-ins, that can be legitimate. If it collects broader device data unrelated to attendance, that would need separate justification and would be vulnerable to challenge on purpose limitation and minimisation grounds.

Can they force you to install it on your personal phone?

This is a distinct and often overlooked point. Requiring you to install software on a device you own, and to consume your own data, battery and storage, is different from requiring you to attend. A well-designed scheme should offer an alternative for students who do not have a suitable smartphone, who object to installing the software, or whose device cannot run it. Insisting there is no alternative at all may itself be disproportionate. Many universities provide manual or lecturer-led check-in as a fallback. If yours does not, that is a legitimate point to raise.

Extra considerations if you are an international student

Universities that sponsor Student visa holders have UKVI attendance monitoring obligations, which is often cited as the justification for these systems. Even so, the monitoring must still comply with data protection law, and the immigration duty is about recording engagement, not tracking your location continuously.

Your practical options

1. Read the app’s privacy notice and the university’s student privacy notice. Identify exactly what data it collects, the stated legal basis, retention periods, and whether background location is used. This tells you how strong your position is.

2. Ask the university, in writing, for its Data Protection Impact Assessment (DPIA) for the app. A DPIA is expected for monitoring of this kind, and you can ask what it concluded about necessity and proportionality. You can also ask whether location is captured once at check-in or tracked continuously.

3. Request an alternative check-in method if you object to installing the app or enabling location, especially if you can attend without it. Frame this around data minimisation and proportionality.

4. If you have specific concerns, submit a subject access request to see what the app has actually recorded about you, and object to processing under Article 21 where the basis is public task, giving your particular reasons.

5. Raise a formal complaint through the university’s data protection officer if you think the collection goes beyond what is necessary.

6. Complain to the Information Commissioner’s Office if the university’s response is unsatisfactory. The ICO is the regulator for UK GDPR and can investigate whether the monitoring is lawful and proportionate.

What would change the answer

The outcome turns heavily on facts you have not yet stated: whether the app takes a single location reading at check-in or tracks you continuously, whether it runs only when open or in the background, what device data it collects and why, whether the university offers any non-app alternative, what legal basis its privacy notice states, and whether you are subject to visa-related attendance monitoring. A single check-in location reading with a manual fallback is very likely lawful. Continuous location tracking, background monitoring, or a refusal to offer any alternative would be a much stronger basis to object and, if necessary, to complain to the ICO.