The iOS privacy manifest: what to declare and how

Some APIs an app needs for normal work can also be misused to fingerprint a device or a person. Apple does not allow fingerprinting, whether or not the user has given permission to track. So for these «required reason» APIs you declare why you use them, you may use them and the data derived from them only for the declared reasons, and those reasons have to match what the app visibly does. None of them may be used for tracking.

Add the NSPrivacyAccessedAPITypes key, an array. For every category of required reason API your code uses, add one dictionary with exactly two keys: NSPrivacyAccessedAPIType, a string set to the category value from the table above, and NSPrivacyAccessedAPITypeReasons, an array of the approved reason codes that match your use. In Xcode, choose Editor > Raw Keys and Values to see the raw key names while you edit, and make sure the reason you pick belongs to the category in the same dictionary. The same file also holds your tracking declaration, tracking domains and collected data types.

Every executable or dynamic library that calls a required reason API needs a privacy manifest in its own bundle. An SDK cannot rely on the app’s manifest, or on another SDK’s, to report its use. Since May 1, 2024, when you add an SDK from Apple’s list of commonly used third-party SDKs, the submission needs that SDK’s privacy manifest, its declared reasons and, if you add it as a binary dependency, a valid signature. In practice: update SDKs to versions that ship a manifest before you upload.

Apple sends an email after an upload that uses a required reason API without a declared reason, and since May 1, 2024 such uploads are not accepted. Read which category the email names, search your code and your SDKs for the API, then either add the category with the matching reason to the manifest of the bundle that calls it, or update the SDK that calls it. Rebuild and upload again; the manifest is read from the build, so the fix is always a new build.

Getting through review is the floor; being found is the rest. Censuus ranks apps by the visits they draw, and adding your app is free on the List my app form. Placement comes from traffic and sponsorship: apps climb on the visits they draw, and a sponsor can pay to rise higher.