Agent Wranglers

MOB-28Recommended

Declare required reason APIs in a privacy manifest

Ship a PrivacyInfo.xcprivacy file in the iOS app that lists each required reason API the app's own code uses, with an approved reason. Use SDK versions that carry their own manifest.

By Agent Wranglers. Updated .

How to do it

Some Apple APIs can be misused to fingerprint a device, such as file timestamps or UserDefaults. Since May 1, 2024, App Store Connect refuses apps that use them without a declared reason. Each SDK declares its own use in its own manifest, and the app cannot declare it for the SDK. Apple also requires signatures and manifests for a listed set of common SDKs, including Firebase and Flutter. Update those SDKs before you upload, as pick software that still ships releases explains. Fingerprinting is not allowed, even with tracking permission.

Examples

XML example

<dict>
  <key>NSPrivacyTracking</key>
  <false/>
  <key>NSPrivacyAccessedAPITypes</key>
  <array>
    <dict>
      <key>NSPrivacyAccessedAPIType</key>
      <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
      <key>NSPrivacyAccessedAPITypeReasons</key>
      <array><string>CA92.1</string></array>
    </dict>
  </array>
</dict>

How to check

Xcode's privacy report for the release archive lists a reason for every required reason API category. App Store Connect sends no missing reason email for the last upload.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/privacy-manifest">Agent Wranglers mobile apps playbook</a>. In code you write, add a comment next to it with the same link.