Privacy manifests and the app privacy report
privacy-manifest responsibilities.
PrivacyInfo.xcprivacy declares collected data types, tracking, and reasons for required-reason APIs; Xcode aggregates your manifest plus SDK manifests into a privacy report.
What's really being asked
The interviewer checks current knowledge of Apple's privacy-manifest requirements and whether you grasp that you remain accountable for the whole app's data behaviour even when SDKs declare their own.
The full answer
PrivacyInfo.xcprivacy is a property-list file bundled in your app or framework that declares the categories of data collected, whether each is linked to the user or used for tracking, and the approved reason codes for any required-reason APIs the code calls, such as file timestamps or user defaults. As the app developer you provide your own manifest for the data your code collects. Third-party SDKs, especially those on Apple's commonly-used list, must ship their own manifests, and certain SDKs must also be signed. Xcode aggregates your manifest together with all included SDK manifests to produce an app privacy report, a summary of the combined data collection and the required-reason API usages across the bundle, which you use to fill out and verify the privacy nutrition labels on the App Store product page.
The mistakes people make
Assuming an SDK's manifest covers your own data collection, when you must still declare what your code does. Believing the manifest is optional for the categories Apple now enforces. Confusing the on-device privacy report Xcode generates with the public App Store privacy labels, though they should agree.
What usually comes next
What are required-reason APIs and why do they exist? Which SDKs additionally require signatures? How does the aggregated report relate to your App Store privacy labels?
A concrete example
You add an analytics SDK that collects device identifiers for tracking and ships its own PrivacyInfo.xcprivacy declaring that. You also write code reading the system boot time, a required-reason API, so your own manifest declares the approved reason. At archive time Xcode aggregates both manifests into a privacy report listing the analytics SDK's identifier collection and your required-reason usage. You read that report to ensure your App Store privacy labels accurately disclose the tracking, remaining responsible for the app as a whole rather than deferring to the SDK's declaration.
Interview question
How does a third-party SDK's privacy manifest relate to your responsibilities as the app developer?
- a.It fully replaces your own manifest and your privacy-label obligations
- b.It is aggregated with your manifest into the report, but you remain accountable for your own declarationsCorrect
- c.It exempts your app from App Store privacy labels
- d.It only matters if the SDK is open source
Why? this is the answer
Xcode combines SDK manifests with yours into the privacy report, yet you must still declare your own data use and keep your App Store labels accurate. The SDK manifest neither replaces your duties nor exempts your app from labels.
Just read this? Test yourself on what you have been reading.
Read the original → developer.apple.com
- #ios
- #privacy-manifest
- #xcprivacy
- #app-store
- #third-party-sdk
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on ios — each one lists the topics its interview covers.
See open roles