App Store privacy labels: how to fill in App Privacy

Apple defines collecting as transmitting data off the device in a way that lets you or your third-party partners access it for longer than it takes to service the request. Data processed only on the device isn't collected. Neither is an IP address or auth token sent with a request and not kept, and you don't declare what Apple itself collects through App Analytics or In-App Purchase payments.

A few things surprise people. Data collected only for app functionality still has to be declared. A web view's traffic counts unless the user is browsing the open web. Free-text fields count as Other User Content, but if you ask for something specific, like a name, declare that type.

Data is linked when it's tied to the user's identity through their account, device or other details, which is the default. To call it not linked, you strip direct identifiers like the user ID before collection, never try to link it back afterwards, and never join it with datasets that would re-identify the user. Apple adds that anything counted as personal information or personal data under privacy law is linked.

Tracking means linking data from your app about a user or device with data from other companies' apps, websites or offline properties for targeted advertising or ad measurement, or sharing it with a data broker. That includes embedding an SDK that combines your users' data with other developers' apps for advertising, even if you never use that feature. Linking data only on the device, or sharing it with a data broker solely for fraud prevention or security, isn't tracking.

If you track, you need permission through the App Tracking Transparency framework, and the advertising identifier is all zeros until the user allows it. In a privacy manifest, NSPrivacyTracking set to true requires NSPrivacyTrackingDomains; requests to those domains fail until the user grants permission.

Apple requires your answers to cover every third-party partner whose code is in your app: analytics, ads, crash reporting, sign-in. A crash reporter that uploads logs puts Crash Data on your label.

Apple also publishes a list of commonly used SDKs, Firebase, Facebook, OneSignal, Alamofire, Flutter plug-ins and others among them, that must include a privacy manifest (and a signature when used as a binary) when you submit a new app with them or an update that adds one. Update old versions of those SDKs before you submit.

A privacy manifest is a property list named PrivacyInfo.xcprivacy that your app and each SDK bundle. It records NSPrivacyCollectedDataTypes (each type with linked, tracking and purposes), NSPrivacyTracking, NSPrivacyTrackingDomains and NSPrivacyAccessedAPITypes. To see the combined picture, archive the app (Product > Archive), Control-click the archive in the Organizer and choose Generate Privacy Report. Apple's docs say to refer to that report when you provide your privacy details.

That's the whole link between the two. App Store Connect doesn't import the manifests, and App Privacy has no endpoint in the App Store Connect API, so the questionnaire is answered by hand in the browser. MetaRun's apple_build_privacy_answers tool reads the manifests of your app and its SDKs and returns the exact answers to tick, merged so the strictest declaration wins, plus anything App Review would flag.

Some APIs can be misused to fingerprint a device, so on iOS, iPadOS, tvOS, visionOS and watchOS you must declare why you use them, in five categories (table above), and use them only for those reasons. The declaration goes in the manifest of the bundle that contains the calling code, your app's for your code and the SDK's for its own; Apple says an SDK can't rely on the app's manifest. Since May 1, 2024, App Store Connect doesn't accept apps that use these APIs without a declared reason.

Whenever your practices change: a new or removed SDK, a feature that sends new data off the device, a new purpose such as ads. You can update answers at any time without an app update, and publishing means agreeing to update them promptly. Apple's help also says answers should reflect the version that's on the App Store, so in practice publish the change when the version that causes it goes live.

App Privacy is the questionnaire behind your App Store privacy label: 35 data types, six purposes, linked or not, tracking or not, for your code and every SDK you ship. Getting it wrong is a common rejection, and Apple's API can't read or write it.

A coding agent has the input App Privacy needs: your PrivacyInfo.xcprivacy and the ones inside each Swift package or pod. MetaRun maps them one to one onto App Store Connect's answers and flags what App Review rejects. The age rating and export compliance do have an API, and go through previews.