Privacy manifests and the app privacy report

WHAT THIS TESTS The interviewer checks current knowledge of Apple's privacy-manifest requirements and whether you grasp that you remain accountable for the whole app's data behaviour even when SDKs declare their own.

A GOOD ANSWER COVERS PrivacyInfo.xcprivacy is a property-list file bundled in your app or framework that declares the categories of data collected, whether each is linked to the user or used for tracking, and the approved reason codes for any required-reason APIs the code calls, such as file timestamps or user defaults. As the app developer you provide your own manifest for the data your code collects. Third-party SDKs, especially those on Apple's commonly-used list, must ship their own manifests, and certain SDKs must also be signed. Xcode aggregates your manifest together with all included SDK manifests to produce an app privacy report, a summary of the combined data collection and the required-reason API usages across the bundle, which you use to fill out and verify the privacy nutrition labels on the App Store product page.

COMMON WRONG ANSWERS Assuming an SDK's manifest covers your own data collection, when you must still declare what your code does. Believing the manifest is optional for the categories Apple now enforces. Confusing the on-device privacy report Xcode generates with the public App Store privacy labels, though they should agree.

LIKELY FOLLOW-UPS What are required-reason APIs and why do they exist? Which SDKs additionally require signatures? How does the aggregated report relate to your App Store privacy labels?

ONE CONCRETE EXAMPLE You add an analytics SDK that collects device identifiers for tracking and ships its own PrivacyInfo.xcprivacy declaring that. You also write code reading the system boot time, a required-reason API, so your own manifest declares the approved reason. At archive time Xcode aggregates both manifests into a privacy report listing the analytics SDK's identifier collection and your required-reason usage. You read that report to ensure your App Store privacy labels accurately disclose the tracking, remaining responsible for the app as a whole rather than deferring to the SDK's declaration.