BYOD vs COPE vs CYOD: three device models compared

BYOD, COPE and CYOD differ in who owns the device and who picks it. With BYOD, employees work on their own smartphone. With COPE, they use a company device that may also be used privately. CYOD is COPE with a choice: employees pick their model from an approved list, for example through a device as a service provider like Everphone.

For most companies, a company device with permitted private use is a better choice than BYOD. It is cheaper from a tax point of view and easier for IT to manage.

On paper, BYOD saves hardware costs, but it shifts effort into data protection, support and offboarding. It also leaves many employees uneasy about work IT suddenly sitting on their private phone. Without a dedicated management app it doesn't work anyway, which is one reason why BYOD is dead, as Everphone CEO Jan Dzulko put it back in 2019.

We explain the terms COPE, COBO and COSU in detail in our article on MDM and COPE with private use. This article is about the decision: which approach fits your company, and how do you tell?

The three device models at a glance

The most important difference is ownership. Who owns the device decides what IT may do on it, who pays in case of loss and how the employer can support employees from a tax perspective.

There is also COBO (corporate-owned, business only): a company device without private use. It suits devices with a clear function, such as scanners in a warehouse or tablets in nursing care.

As a work phone for office staff, COBO often means people carry two smartphones. Resentment is built in.

BYOD: when a private smartphone makes sense at work

BYOD only makes sense if employees need their smartphone for work rarely and for tasks that aren't sensitive. Typical examples are an authenticator app for logging in to a laptop or the occasional look at the calendar.

As soon as customer data, email or business applications land on the device, BYOD becomes expensive to run.

The company stays responsible for company data on the private device but must not interfere with the employee's privacy. Our article on the legal aspects of BYOD describes how these rights are separated.

Technically, this can be solved. On Android, a work profile separates company apps from the rest of the device. On iPhones the equivalent is called User Enrollment: a managed Apple account sits next to the private one, and IT sees neither the serial number nor private apps (Apple).

The catch is everyday life.

• Employees use all kinds of smartphones, some with outdated operating systems.
• If the device breaks, work stops until the person finds a replacement privately.
• And anyone who doesn't want a company profile on their own phone can refuse.

What BYOD brings tax-wise

From a tax perspective, BYOD loses against a company device. If the employer provides a smartphone in Germany, private use is tax-free for employees, no matter how large the private share is. This is regulated in Section 3 No. 45 of the German Income Tax Act (EStG), and it also covers the mobile plan.

With BYOD, the employer can only reimburse business costs. Without individual proof, that is a flat 20% of the mobile phone bill, up to a maximum of €20 per month (Haufe on R 3.50 LStR).

A cash contribution towards buying the private device does not fall under Section 3 No. 45 EStG, because the device belongs to the employee.

An example: Lena pays €40 a month for her phone contract and also uses her smartphone for work. Without individual proof, the employer may reimburse her €8 a month tax-free, which is €96 a year.

With a company device including a plan, she pays nothing for the device and the contract, not even for private use.

For employers, this means BYOD is not a benefit but a shifting of costs to employees. You can find more on the tax side in our article on work phone taxes.

COPE: the company phone that counts privately too

COPE is the best default for most companies. The device belongs to the company, IT sets it up centrally, and employees only need one smartphone.

Many employees worry: will IT see my photos? On current devices, no. Since Android 11, Android treats the private area of a COPE device almost like a separate, private device.

IT manages the work profile and some device settings but sees no private apps or data (Bayton). Our article on data separation on the company phone shows how the separation works in detail.

For company-owned iPhones, setup runs through Automated Device Enrollment.

The device is then "supervised", and IT can lock it, put it into lost mode or wipe it completely. Even an MDM cannot read photos, messages or the content of private apps.

The advantage shows most when someone leaves. The device comes back, is wiped and goes to the next person. With BYOD, on the other hand, it stays unclear whether all company data has left the private device.

CYOD: COPE with a choice for employees

CYOD solves the biggest problem of COPE: not everyone wants the same smartphone. IT defines which models are eligible, for example three iPhones and two Android devices. Employees choose from those themselves.

The fleet stays manageable for IT. It supports five models instead of fifty, and all of them are set up cleanly in the MDM. For employees, the device feels like their own, even though it belongs to the company.

At Everphone, this includes an optional top-up: anyone who wants a more expensive model than planned pays the difference themselves and can go for the Pro, XL or Fold devices.

Employees choose from the approved devices, and the amount of any top-up is of course shown during selection. The page on choose your own device shows what this looks like in practice.

CYOD is especially worthwhile when smartphones are also an argument in recruiting. A company phone nobody chose is a work tool. A device people picked themselves, with private use allowed, is seen as a perk. You can read more in our whitepaper on the company phone as a benefit.

Data protection and works councils: what applies to every model

Whichever model you choose: as soon as an MDM manages devices, it is generally a technical system that can monitor behaviour or performance. If your company has a works council, it therefore has a co-determination right under Section 87(1) No. 6 of the German Works Constitution Act (BetrVG).

So plan for a works agreement that sets out which data IT can see and which it cannot.

With BYOD, you also need a written agreement with each employee, because it concerns a private device. Our article on company phone monitoring describes what employers may check on company devices.

Which device model fits your company

The decision depends less on company size than on how important the smartphone is for the work.

• BYOD fits if the smartphone is a side issue: app-based login, the occasional calendar entry, no customer data.
• COPE fits if employees work with email, chat and business applications on their smartphone every day and you want to keep the fleet lean.
• CYOD fits if you also value employee satisfaction and employer branding and still want IT to support only a few models.

If you decide on company devices, you don't have to buy and manage them yourself. With device as a service, you rent the devices, and setup, MDM, replacement and return are part of the service.

Frequently asked questions

Is BYOD allowed in Germany?

Yes, BYOD is allowed. However, an employer may not require employees to use their private smartphone for work. You need an agreement on usage, cost reimbursement and data access, plus a technical separation of private and work data.

Can the employer see private data on a COPE device?

On current Android and Apple devices, the private area is technically separated from the work area. IT manages company apps and security settings but sees no private photos or messages. On company-owned iPhones, however, it can retrieve the list of installed apps. What exactly is collected should be set out in a works agreement.

What is the difference between COPE and CYOD?

In both cases the device belongs to the company. With COPE, IT decides on the model. With CYOD, employees choose from a list of approved models themselves, sometimes with a top-up for a more expensive device.

What does COBO mean?

COBO stands for corporate-owned, business only. The device belongs to the company and may only be used for work. It suits devices with a fixed task, such as scanners, point-of-sale devices or nursing tablets.

Is BYOD cheaper than a company phone?

Only at first glance. The employer saves the device price but takes on effort for support, data protection and offboarding. Without proof, the employer can reimburse tax-free no more than €20 a month, while private use of a company device is completely tax-free.