Consent timing is less about a perfect legal phrase and more about when your app starts collecting optional analytics. Many teams show a marketing banner after the home screen loads while analytics has already recorded a dozen events. That mismatch is what audits catch first.
Map three moments: first open, first meaningful action, and first request that depends on optional analytics. Align the prompt so that non-essential collection waits until the person has a real choice. Essential operational logging, if any, should be described separately in your policy language.
For apps serving residents in Thailand, keep records of what version of the prompt shipped and when wording changed. Your analytics steward and your counsel both benefit from that history when questions arise months later.
Test rejection paths with the same seriousness as acceptance. If rejecting consent still leaves marketing pixels active, the interface is incomplete—even when the visual design looks polished.
When you change vendors, re-check timing. A new SDK often reintroduces early collection unless someone explicitly disables it.