The Apple Privacy Manifest is a document every app developer must include when submitting an app to the App Store. It clearly outlines what data the app collects, why that data is collected, and how it is used.
This requirement is part of Apple’s broader effort to make privacy and data transparency a core standard for all apps distributed through its platforms.
The Apple Privacy Manifest is a file embedded within an app’s code that lists the types of data the app or any third-party SDKs collect. It explains the purpose behind each data collection activity and ensures developers declare any external domains used for tracking or analytics.
When developers upload an app to the App Store, Xcode compiles all privacy manifests, including those from third-party SDKs, and generates a detailed privacy report. This report becomes visible in the app’s privacy information section on the App Store, giving users a transparent view of how their information is handled.
This initiative reinforces Apple’s long-standing privacy philosophy: giving users control over their personal data and making developers accountable for how that data is used.
Before this system, many app developers relied on third-party SDKs without full visibility into the data those SDKs collected. This created gaps in privacy disclosures and exposed users to hidden tracking.
The Privacy Manifest was introduced to fix this. It expands on the Privacy Nutrition Labels (introduced in 2022), offering more detailed and standardized disclosure about data collection practices.
It also supports Apple’s ongoing goal of eliminating probabilistic attribution and fingerprinting. These techniques identify users through device-specific data like IP addresses, installed apps, or device models. Apple’s approach forces transparency and pushes developers toward privacy-compliant attribution through SKAdNetwork.
Starting from iOS 17, every app and SDK must include a Privacy Manifest with four key entries:
1. NSPrivacyTracking
Indicates whether the app requests permission to track users across apps or websites owned by other companies. This aligns with Apple’s App Tracking Transparency (ATT) policy.
2. NSPrivacyTrackingDomains
Lists any external domains that the app or an SDK communicates with for tracking or analytics. Apple can block connections to undeclared domains if a user does not grant tracking consent.
3. NSPrivacyCollectedDataTypes
Describes all types of data collected by the app or its SDKs, along with:
This creates a clear, standardized structure that allows Apple to summarize the data practices within each app.
4. NSPrivacyAccessedAPITypes
Declares which APIs are accessed by the app or SDK. Developers must specify why these APIs are used to prevent misuse or indirect fingerprinting. Even with user consent, fingerprinting is prohibited.
Developers can easily create a Privacy Manifest using Xcode.
Steps to create one:
The file will be named PrivacyInfo.xcprivacy, which is the required name for all bundled manifests. Developers should add this file to their app’s resources to ensure it is included when generating a privacy report.
At the top level of the file, include the following keys:
NSPrivacyTracking, NSPrivacyTrackingDomains, NSPrivacyCollectedDataTypes, and NSPrivacyAccessedAPITypes.
This process ensures the app’s privacy details are clearly declared and automatically integrated into Apple’s system for public display.
Below is an example of how contact information might be declared in a privacy manifest:
NSPrivacyCollectedDataTypes:
- Contact Info
Linked To User: Yes
Used For Tracking: No
Purpose: Account Management
This example shows that contact information is collected only for managing user accounts and is not used for tracking or advertising.
The Apple Privacy Manifest helps protect users and developers alike.
For users, it ensures they know exactly what data is collected and why.
For developers and marketers, it builds trust and ensures compliance with Apple’s strict privacy standards.
Apps that fail to include or accurately declare their Privacy Manifest risk being rejected from the App Store.
To provide transparency around data collection and ensure users understand how their personal information is used.
Yes. Every new or updated app on the App Store must include one, including third-party SDKs bundled with the app.
It is embedded in the app bundle as a file named PrivacyInfo.xcprivacy.
Apple scans and compiles all manifest data into a privacy report, displayed publicly on the App Store for users to review.
Yes. Apple specifically prohibits fingerprinting and requires developers to explain all uses of APIs that could be used for this purpose.
Yes. The Privacy Manifest complements SKAdNetwork by encouraging privacy-safe attribution without tracking individual users.
Apps without an accurate Privacy Manifest may be rejected from the App Store or removed if found non-compliant.
Every iOS, iPadOS, watchOS, tvOS, and visionOS app must include a Privacy Manifest.
The file is named PrivacyInfo.xcprivacy and is created in Xcode.
Apps that fail to comply risk rejection or removal from the App Store.