---
title: "Declare required reason APIs in a privacy · Agent Wranglers"
url: https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/privacy-manifest
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Declare required reason APIs in a privacy manifest

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Privacy declarations](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: MOB-28
- Level: Recommended
- Chapter: [Privacy declarations](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations)
- Rule: Ship a `PrivacyInfo.xcprivacy` file in the iOS app that lists each required reason API the app's own code uses, with an approved reason. Use SDK versions that carry their own manifest.
- How: Some Apple APIs can be misused to fingerprint a device, such as file timestamps or `UserDefaults`. Since May 1, 2024, App Store Connect refuses apps that use them without a declared reason. Each SDK declares its own use in its own manifest, and the app cannot declare it for the SDK. Apple also requires signatures and manifests for a listed set of common SDKs, including Firebase and Flutter. Update those SDKs before you upload, as [pick software that still ships releases](https://agentwranglers.se/playbook/stack/how-to-choose/still-maintained) explains. Fingerprinting is not allowed, even with tracking permission.
- Check: Xcode's privacy report for the release archive lists a reason for every required reason API category. App Store Connect sends no missing reason email for the last upload.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### XML example

```xml
<dict>
  <key>NSPrivacyTracking</key>
  <false/>
  <key>NSPrivacyAccessedAPITypes</key>
  <array>
    <dict>
      <key>NSPrivacyAccessedAPIType</key>
      <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
      <key>NSPrivacyAccessedAPITypeReasons</key>
      <array><string>CA92.1</string></array>
    </dict>
  </array>
</dict>
```

## Sources

- [Apple, Describing use of required reason API](https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api)
- [Apple, Third-party SDK requirements](https://developer.apple.com/support/third-party-SDK-requirements/)

## Related rules

- [Pick software that still ships releases](https://agentwranglers.se/playbook/stack/how-to-choose/still-maintained) in Software choices

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/privacy-manifest">Agent Wranglers mobile apps playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Fill in the store privacy forms from an SDK list](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/store-privacy-forms)
- Next: [Ask before any tracking](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/tracking-permission)
- [Privacy declarations](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations)