What is a privacy manifest, what are required-reason APIs, and what must third-party SDKs declare?

14.3.1 · L5 · Interview

Predict first

A manifest dictionary is serialised to a property list and read back. Which top-level keys does it contain?

import Foundation

let manifest: [String: Any] = [
    "NSPrivacyTracking": false,
    "NSPrivacyTrackingDomains": [String](),
    "NSPrivacyCollectedDataTypes": [[String: Any]](),
    "NSPrivacyAccessedAPITypes": [["NSPrivacyAccessedAPIType": "NSPrivacyAccessedAPICategoryUserDefaults", "NSPrivacyAccessedAPITypeReasons": ["CA92.1"]]]
]
let xml = try PropertyListSerialization.data(fromPropertyList: manifest, format: .xml, options: 0)
let back = try PropertyListSerialization.propertyList(from: xml, format: nil) as! [String: Any]
print(back.keys.sorted())

["NSPrivacyAccessedAPITypes", "NSPrivacyCollectedDataTypes", "NSPrivacyTracking", "NSPrivacyTrackingDomains"]
["NSPrivacyTracking"]
[]

Mental model. A privacy manifest is the ingredients and allergens list on food packaging: machine-readable, checked by an inspector, and required for every supplier whose parts are in the product.

A privacy manifest is a property-list file named PrivacyInfo.xcprivacy that an app, framework or SDK includes to declare its data practices in a machine-readable form. App Store Connect and Xcode combine the manifests of the app and all its dependencies into a privacy report, and the store checks them. Its main keys: NSPrivacyTracking (a boolean: does the app or SDK use data for tracking as Apple defines it), NSPrivacyTrackingDomains (domains used for tracking, which the system blocks when the user has not allowed tracking), NSPrivacyCollectedDataTypes (an array describing each type of data collected, whether it is linked to the user, used for tracking, and the purposes) and NSPrivacyAccessedAPITypes (the required-reason APIs the code uses, each with the approved reason codes). Because it is a plist, you can build and inspect one in code: a dictionary with these four keys round-trips through PropertyListSerialization.

Required-reason APIs are system APIs that are easy to misuse for fingerprinting (identifying a device without permission). The categories include file timestamps (creationDate, modificationDate, stat), system boot time (systemUptime, mach_absolute_time), disk space, active keyboards and UserDefaults. If your code (or an SDK you ship) calls them, the manifest must list the category and one of Apple’s approved reasons for using it (for example the code CA92.1 for reading and writing UserDefaults values that only your app accesses), and you may use the API only for that reason. Missing or wrong declarations lead to App Store Connect warnings and rejection. Third-party SDKs on Apple’s list must ship their own manifest and be signed (since the supply chain matters), and the app’s combined report shows what they declare. Practical workflow: add the manifest to each target, run Product ▸ Archive ▸ Generate Privacy Report to check the merged result, audit your SDKs and remove those you do not need, keep it in sync with the App Store privacy “nutrition labels”, and update it when you add an analytics or ads SDK. Being accurate matters more than being minimal: the declarations are a promise that review and users rely on.

A privacy manifest is an ordinary property list with these four top-level keys.

Common traps

Using UserDefaults or file timestamps and not declaring the reason. The build is flagged and the submission can be rejected; declare the category and an approved reason.
Assuming SDKs handled their own declarations. Listed SDKs must include and sign a manifest; check the merged privacy report.

They might follow up with

What does NSPrivacyTrackingDomains do? Connections to those domains are blocked unless the user allowed tracking.
Why list reasons for UserDefaults? It is a required-reason API that can be misused for fingerprinting, so you must state an approved reason.

What is a privacy manifest, what are required-reason APIs, and what must third-party SDKs declare?

Predict first

Common traps

They might follow up with

Related questions