What is App Tracking Transparency, when must you ask, and what is allowed without permission?
Predict first
What are the raw values of the tracking authorization statuses, and the initial one?
import AppTrackingTransparency
print(ATTrackingManager.trackingAuthorizationStatus.rawValue, ATTrackingManager.AuthorizationStatus.authorized.rawValue, ATTrackingManager.AuthorizationStatus.denied.rawValue)- 0 3 2
- 3 0 1
- 1 3 2
Mental model. ATT is a doorbell: you may not follow a visitor into other houses to learn about them unless they let you in. Counting how many people entered your own house needs no permission.
Apple defines tracking as linking data collected from your app with data from other companies’ apps, websites or offline sources for advertising or advertising measurement, or sharing user or device data with data brokers. Doing that requires the user’s permission through App Tracking Transparency (AppTrackingTransparency): you call ATTrackingManager.requestTrackingAuthorization (async), after setting NSUserTrackingUsageDescription in Info.plist, and the system shows its fixed prompt with your reason string. The result is a status: notDetermined (0), restricted (1) (for example parental controls: you may not ask), denied (2) and authorized (3). Only when it is authorized may you read the IDFA (ASIdentifierManager.advertisingIdentifier, which otherwise returns all zeros), and the same permission gates other tracking: data sharing with ad networks that links across apps, and the tracking domains declared in your privacy manifest. You must respect denial: do not ask repeatedly, do not gate features on it, do not use workarounds (fingerprinting, hashed emails passed to ad networks for cross-app matching), as that violates the rules.
What is not tracking, and so needs no ATT prompt: first-party analytics inside your own app, linking data only within your own apps, fraud detection and security, on-device processing, privacy-preserving attribution (SKAdNetwork and AdAttributionKit, which do not use the IDFA), and sharing with a service provider acting only for you. Use the identifier for vendors (identifierForVendor) for your own cross-app consistency, understanding that it resets when all your apps are removed. Practical advice: ask in context, after explaining the value in your own UI (a pre-prompt screen that does not mimic the system one), at a moment the user understands why, and only if you really track; if you do not track, do not ask and do not include a tracking SDK. Check your SDKs, since an ads or analytics SDK may track on your behalf and make your declaration wrong. Keep the privacy manifest, the App Store privacy labels and the actual behaviour consistent, because review compares them. The user can change the setting any time in Settings, so read the status each launch.
A fresh app is notDetermined (0), authorized is 3 and denied is 2 (restricted is 1).
Common traps
- Reading the IDFA without authorization. It returns zeros; do not rely on it or work around it.
- Including a tracking SDK and not asking. You are tracking through it; the declaration and the prompt must match.
They might follow up with
- What status means “do not ask”?
restricted; the user cannot grant permission. - Does first-party analytics need ATT? No, only data linked with other companies’ data for advertising or measurement.
Related questions
- 14.3.1 What is a privacy manifest, what are required-reason APIs, and what must third-party SDKs declare?
- 14.3.3 How do you keep personal data out of logs, screenshots, the pasteboard and the app switcher?
- 14.5.1 How would you threat-model a consumer app that handles accounts, payments and personal data?
← What is a privacy manifest, what are required-reason APIs, and what… How do you keep personal data out of logs, screenshots, the… →