Privacy Manifests Become Mandatory

What Changed

Apple announced privacy manifests at WWDC in June 2023, and began enforcing them for App Store submissions from May 1, 2024.^1,2

A privacy manifest is a file, included in an app or a third-party SDK, that declares the data it collects, the domains it contacts for tracking, and the reasons it uses certain APIs. Apple designated a set of "required reason APIs": system interfaces that could be misused to collect device signals and identify the device or user, known as fingerprinting.³ Apps and SDKs must declare an approved reason for using any of them. Apple publishes a list of commonly used third-party SDKs that must include a manifest, and a signature from their makers when added as binary dependencies.²

If an app declares tracking domains in its manifest and the user hasn't given permission through App Tracking Transparency, iOS blocks network connections to those domains.¹

Why It Mattered

App Store privacy labels had relied on developers describing their own apps, including SDKs they didn't write. Privacy manifests moved responsibility to the SDK makers and gave Apple a technical way to enforce tracking choices: if a declared tracking domain is blocked without permission, the SDK can't send tracking data there.

Enforcement has limits. In May 2024, researchers from the security firm Mysk reported that several major apps appeared to use required reason APIs without sticking to their declared reasons, as reported by The Register.⁴ Apple's rules forbid fingerprinting in principle, but checking how every app uses every API is hard.

Manifests also show how Apple now combines policy with technical enforcement. App Tracking Transparency set the rule that tracking needs permission; manifests give iOS a list of the domains to block when permission is missing. That approach, naming specific domains and blocking them, reappeared at a much larger scale in iOS 27's block list for Safari.