Hello, thanks for sharing your concerns.
Generally we provide the following solutions to help be GDPR and CCPA compliant. These options have been sufficient for all users around the world.
1 – We provide methods that allow you to pause OneSignal initialization so you can ask users to opt-in to sharing their data with services you use. We recommend that you disclose and get consent by displaying a dialog box to users. Read more about this in our Data Handling Guide: https://documentation.onesignal.com/docs/handling-personal-data
2 – We provide ways to delete user records and specific PII data. More here: https://documentation.onesignal.com/docs/delete-users
3 – Our paid plans provide DPA and Model Clauses.
The first 2 options keeps OneSignal free, but puts the burden on you to make sure users opt-in. The third option shifts the onus to us, which requires a paid plan.
