No warning email received from Apple even though we upload an app version WITHOUT Privacy manifest

Being a software company we create and distribute an iOS SDK with our customers world wide. The distribution of the software is in the form of a static library / XCFramework to our customers. They will integrate the SDK and use it to collect data from their hosting as first party.

As Apple enforced through this article “Describing use of required reason API” - “starting from Fall 2023 you’ll receive an email from Apple if you upload an app to App Store Connect that uses required reason API without describing the reason in its privacy manifest file”.

We are using "NSUserDefaults” in our SDK which is one among the required API listed, and as of now we didn’t create a Privacy manifest file and declared this on the SDK. We tried uploading our app to the Appstore connect portal, as we are not complying with the requirement from Apple we expect to see the warning message.

Currently we are unknown about the impact of not having the Privacy manifest, and we would like to test the scenarios and make sure we are declaring the correct information on our SDK.

Please could you review this and let us know why we are not receiving the emails. Or is that Apple didn’t harden the uploads yet and something planned for future date?

Post not yet marked as solved Up vote post of achuthan Down vote post of achuthan
1.4k views

Replies

They haven't enabled it yet, as far as I am aware. (I suspect that the forum will be full of posts about it when they do turn it on.)

After March 13th, we uploaded IPA packages without a privacy manifest and we still haven't received a warning email from AppStore Connect. So even if we add a privacy manifest, we still can't verify that the privacy manifest we've added in the IPA is correct. Has anyone encountered this situation, is Apple grayscale releasing this feature?

  • See this thread.

  • As far as I know. Currently, only the SDKs in the blacklist are objects that must be added to the privacy list. In addition, if the privacy and security API is called within the app, it must be declared. It is still unclear how Apple conducts automatic review and judgment internally.

Add a Comment