Understanding privacy manifests in iOS

Many iOS apps include third-party dependencies, such as analytics SDKs, networking libraries or crash reporting tools. Some of these dependencies may collect data or access privacy-sensitive APIs.

Privacy manifests help make this behavior more explicit. In this article, we'll look at what privacy manifests are, how they relate to third-party SDKs and what required reason APIs mean for privacy declarations.

Let's dive in.

Architecture & Design Patterns for iOS

This book is a practical guide to essential architectural principles and design patterns for iOS development. It covers strategies for building maintainable apps with Swift and SwiftUI, including dependency injection, navigation, common patterns, and modularization.

LEARN MORE

What is a privacy manifest?

A privacy manifest is a file that describes privacy-relevant behavior of an app or SDK in a standard format.

The file is called PrivacyInfo.xcprivacy and is added to the app target or to an SDK. It can declare information such as:

• what types of data are collected
• whether collected data is linked to the user
• whether collected data is used for tracking
• which required reason APIs are accessed

To add one in Xcode, we can select File -> New -> File and choose the App Privacy file template. Xcode creates a file named PrivacyInfo.xcprivacy, which should be included in the target membership of the app or SDK that declares the privacy behavior.

The privacy manifest itself does not collect data or change the runtime behavior of an app. It is a declaration file that helps describe what the app or SDK does from a privacy perspective.

For example, if an app sends a user’s email address to a backend for account functionality and uses UserDefaults for storing app settings, the manifest could contain entries like this:

<key>NSPrivacyTracking</key>
<false/>
<key>NSPrivacyCollectedDataTypes</key>
<array>
    <dict>
        <key>NSPrivacyCollectedDataType</key>
        <string>NSPrivacyCollectedDataTypeEmailAddress</string>
        <key>NSPrivacyCollectedDataTypeLinked</key>
        <true/>
        <key>NSPrivacyCollectedDataTypeTracking</key>
        <false/>
        <key>NSPrivacyCollectedDataTypePurposes</key>
        <array>
            <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
        </array>
    </dict>
</array>
<key>NSPrivacyAccessedAPITypes</key>
<array>
    <dict>
        <key>NSPrivacyAccessedAPIType</key>
        <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
        <key>NSPrivacyAccessedAPITypeReasons</key>
        <array>
            <string>CA92.1</string>
        </array>
    </dict>
</array>

This example declares that the app does not use the collected data for tracking, collects an email address for app functionality and accesses the UserDefaults required reason API category.

In Xcode, the file can be edited as a property list, so we usually don't have to write the XML manually.

Privacy manifests and third-party SDKs

Privacy manifests are especially important for third-party SDKs because the privacy behavior of an app is not limited to its own source code.

If we integrate an analytics SDK, a crash reporting SDK, an authentication SDK or another dependency, that code may also collect data or access privacy-sensitive APIs. A privacy manifest makes this more visible by showing what the SDK declares and whether it matches how we use the SDK in the app.

Generating a privacy report in Xcode

After archiving an app, we can use Xcode to generate a privacy report.

The privacy report is a developer-facing summary. It helps us inspect the privacy declarations from the app and its embedded dependencies before submitting the app. This information can be used to keep the App Store privacy labels accurate.

Required reason APIs

Required reason APIs are APIs that Apple considers privacy-sensitive because they can potentially be used for fingerprinting.

Fingerprinting means collecting signals about a device or user and combining them to identify that user across apps or websites. Some APIs do not look obviously privacy-related at first, but can still reveal useful device-specific information when combined with other signals.

Examples of required reason API categories include:

• file timestamp APIs
• system boot time APIs
• disk space APIs
• active keyboard APIs
• user defaults APIs

If an app or SDK uses one of these APIs, the privacy manifest must declare the API category and provide an approved reason for using it.

An example declaration for using UserDefaults might look like this:

<key>NSPrivacyAccessedAPITypes</key>
<array>
    <dict>
        <key>NSPrivacyAccessedAPIType</key>
        <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
        <key>NSPrivacyAccessedAPITypeReasons</key>
        <array>
            <string>CA92.1</string>
        </array>
    </dict>
</array>

Here, NSPrivacyAccessedAPICategoryUserDefaults declares the accessed API category, while CA92.1 is the approved reason code. In this case, CA92.1 means that the app accesses UserDefaults to read or write information that is only used by the app itself, for example local settings or preferences.

This is also relevant for third-party SDKs. Even if our own app code does not directly access a required reason API, an SDK might. In that case, the SDK's privacy manifest should declare that usage.