This is about simplifying creation of Privacy Nutrition Labels and holding developers accountable for the APIs and SDKs they use.
You are responsible for all code in your app. I can image a fight brewing now between SDK creators and developers, who are ultimately responsible for the usage of these SDKs.
I highly recommend you check out this presentation yourself at https://developer.apple.com/wwdc23/10060
Privacy manifests
- Third party developers can provide information about their SDK to be included in your app.
- Create a PrivacyInfo.xcprivacy file in Xcode which defines the data collected and linked to the app, and how it is being used (Should update this for my own apps).
- Check App privacy details on the App Store Documentation
Privacy Report
- This pulls together all the information in one place. It will aggregate across all content. Right click on context menu for a App Archive, and choose Generate Privacy Report
- This only works if you have created PrivacyInfo.xcprivacy files and they must be included in the archive
Tracking domains
- Control network connections from your app.
- Some SDKs may default to tracking or depend on you to request permission and will assume yes.
- If you specify domains in your privacy manifest it will automatically disallow tracking unless the user agrees.
- If the same domain has both tracking and non-tracking functions – split the domain to track this
- Xcode Instruments will show you domains that are used to track across websites. So you should run this instrument on your code to confirm that you are OK, Then you can declare the value in your privacy manifest
- Fingerprinting is NEVER allowed
Required reason APIs
- For important use cases while avoiding finger printing, Apple has created groups of categories of APIs with a list of approved reasons
- For example NSFileSystemFreeSize (disk space) check Required APIs in developer APIs
- Documentation links to a feedback form if you have a valid reason
- You must clearly state why you use these APIs in your Privacy Manifest
- Check the Privacy-impacting SDKs in the developer documentation
Starting in fall 2023, apple will start sending informational emails to developers. Starting in Spring 2024 they must reviewed and addressed. Also Privacy manifests will be expected at that point.