An ITMS-91061: Missing privacy manifest rejection email looks as follows: ITMS-91061: Missing privacy manifest- Your app includes "<path/to/SDK>", which includes , an SDK that was identified in the documentation as a privacy-impacting third-party SDK. Starting February 12, 2025, if a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a privacy manifest file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a privacy manifest. For more details about this policy, including a list of SDKs that are required to include signatures and manifests, visit: https://developer.apple.com/support/third-party-SDK-requirements. Glossary ITMS-91061: Missing privacy manifest: An email that includes the name and path of privacy-impacting SDK(s) with no privacy manifest files in your app bundle. For more information, see https://developer.apple.com/support/third-party-SDK-requirements. : The specified privacy-impacting SDK that doesn't include a privacy manifest file. If you are the developer of the rejected app, gather the name of the SDK from the email you received from Apple, then contact the SDK's provider for an updated version that includes a valid privacy manifest. After receiving an updated version of the SDK, verify the SDK includes a valid privacy manifest file at the expected location. For more information, see Adding a privacy manifest to your app or third-party SDK. If your app includes a privacy manifest file, make sure the file only describes the privacy practices of your app. Do not add the privacy practices of the SDK to your app's privacy manifest. If the email lists multiple SDKs, repeat the above process for all of them. If you are the developer of an SDK listed in the email, publish an updated version of your SDK that includes a privacy manifest file with valid keys and values. Every privacy-impacting SDK must contain a privacy manifest file that only describes its privacy practices. To learn how to add a valid privacy manifest to your SDK, see the Additional resources section below. Additional resources Privacy manifest files Describing data use in privacy manifests Describing use of required reason API Adding a privacy manifest to your app or third-party SDK TN3182: Adding privacy tracking keys to your privacy manifest TN3183: Adding required reason API entries to your privacy manifest TN3184: Adding data collection details to your privacy manifest TN3181: Debugging an invalid privacy manifest

I am developing a React Native app for a health monitoring device that connects via Bluetooth and streams live data on iOS. To ensure the uniqueness of the device, I initially planned to use the MAC address. However, I discovered that iOS does not provide access to the original MAC address due to privacy restrictions. Is there an alternative approach to uniquely identifying a Bluetooth device in iOS? I need a reliable way to distinguish devices while maintaining secure and stable connections. Any insights or best practices on handling this in iOS would be greatly appreciated. Looking forward to hearing your suggestions! If anyone has experience with handling Bluetooth device uniqueness on iOS, please share your insights. Thank you!

Hello. We have several apps, that use battery information, such as charge level and battery charge events. Since iOS 17, instead of report every 1% of charge, all API return an approximate within 5% value of the real value. As a result, that created a lot of issues with our users. Most of them, and at this point its around of million plus users, are not happy, because they will have to wait for the app to return information for literally hours... Please fix this, and even if you wont allow us access to real time data, like in Android devices, please at least return it back to be precise and at 1% of precision.

When you have a mac, creating xcprivacy is pretty straightforward for your app, you simply use xcode, then select the sdks and target them and your privacy manifest is ready. In the other hand, when you are using CI/CD solutions you might not use xcode direclty. In that instance and if you are coding in flutter, you need to create your privacy manifest by hand. I would like guidance how to write that file, I would it for a given third party SDK and where to put that file in the flutter project (just to be sure) For example we choose the most important third party SDK manifest: FUTTER framework. I keep getting errors about it for my app, got alot of builds get the INVALID BINARY error because of that, and my mails indicating me a problem with the manifest. Please show me the source code of the manifest privacy for a project where a third party SDK is present (in particular: flutter sdk) Thanks

Hi, we are preparing to launch an app soon that will allow users to login via their apple or google accounts. We were reviewing the app review guidelines and had some questions about Login Services. Do we need to support username/email + password alongside social logins? If yes, can we support passkeys to get around this restriction? passkeys do not require any information so we think this should apply Apps that use a third-party or social login service (such as Facebook Login, Google Sign-In, Sign in with Twitter, Sign In with LinkedIn, Login with Amazon, or WeChat Login) to set up or authenticate the user’s primary account with the app must also offer as an equivalent option another login service with the following features: - the login service limits data collection to the user’s name and email address; - the login service allows users to keep their email address private as part of setting up their account; and - the login service does not collect interactions with your app for advertising purposes without consent. A user’s primary account is the account they establish with your app for the purposes of identifying themselves, signing in, and accessing your features and associated services.

Hello Apple Developer Community, We have been experiencing a persistent notification issue in our application, Flowace, after updating to macOS 15 and above. The issue is affecting our customers but does not occur on our internal test machines. Issue Description When users share their screen using Flowace, they receive a repetitive system notification stating: "Flowace has accessed your screen and system audio XX times in the past 30 days. You can manage this in settings." This pop-up appears approximately every minute, even though screen sharing and audio access work correctly. This behavior was not present in macOS 15.1.1 or earlier versions and appears to be related to recent privacy enhancements in macOS. Impact on Users The frequent pop-ups disrupt workflows, making it difficult for users to focus while using screen-sharing features. No issues are detected in Privacy &amp; Security Settings, where Flowace has the necessary permissions. The issue is not reproducible on our internal test machines, making troubleshooting difficult. Our application is enterprise level and works all the time, so technically this pop only comes after a period of not using the app. Request for Assistance We would like to understand: Has anyone else encountered a similar issue in macOS 15+? Is there official Apple documentation explaining this new privacy behavior? Are there any interim fixes to suppress or manage these notifications? What are Apple's prospects regarding this feature in upcoming macOS updates? A demonstration of the issue can be seen in the following video: https://youtu.be/njA6mam_Bgw Any insights, workarounds, or recommendations would be highly appreciated! Thank you in advance for your help. Best, Anuj Patil Flowace Team

When I make a local network HTTP request, an error occurs. I'm sure I've granted wireless data permissions and local network permissions, and I'm connected to the correct Wi-Fi. This problem is intermittent, but once it happens, it will keep happening, and the only way to fix it is to restart the phone. Here is the error log: sessionTaskFailed(error: Error Domain=NSURLErrorDomain Code=-1009 "似乎已断开与互联网的连接。" UserInfo={_kCFStreamErrorCodeKey=50, NSUnderlyingError=0x30398a5b0 {Error Domain=kCFErrorDomainCFNetwork Code=-1009 "(null)" UserInfo={_NSURLErrorNWPathKey=unsatisfied (Local network prohibited), interface: en0[802.11], uses wifi, _kCFStreamErrorCodeKey=50, _kCFStreamErrorDomainKey=1}}, _NSURLErrorFailingURLSessionTaskErrorKey=LocalDataTask .&lt;63&gt;, _NSURLErrorRelatedURLSessionTaskErrorKey=( "LocalDataTask .&lt;63&gt;" ), NSLocalizedDescription=似乎已断开与互联网的连接。, NSErrorFailingURLStringKey=http://192.168.2.1:80/v1/parameters, NSErrorFailingURLKey=http://192.168.2.1:80/v1/parameters, _kCFStreamErrorDomainKey=1})

If new photo is added to library and app is not running in foreground or was not opened after the new photo was added but the app is having full access to gallery, can it access, read the new photo - If the app is not specifically a cloud syncing app, can it have this attached function, suppose it is a game app or beauty camera app?

Could anyone teach me how to ask iOS 18 to have a prompt during set-up process of a new APP if user accidentally turns off Local Network ?

Could anyone tell me how to detect status of Local Network for iOS 18+ systems ?

Hello, I’m planning to develop a custom referral-based attribution system for my app. The goal is to log the number of installs that come from unique referral links and then track subsequent in‑app analytics (for example, when a user reaches level 5 in a game). I’d also like to capture the user’s country to further segment these analytics. I want to build this system myself—without relying on third‑party services (such as AppsFlyer or Branch) since I only need a few key data points and want to keep costs low. However, I’m aware of the privacy restrictions in iOS and want to ensure that my implementation complies with Apple’s guidelines. Specifically, I would appreciate guidance on the following: Permissible Signals: Is it acceptable to log signals like IP address (or a suitably anonymized version), device model, and timestamp to help correlate the referral click to a successful install and subsequent in‑app events? Are there any other recommended non‑PII signals that can be used to confirm a referral install without risking rejection during App Review? Best Practices: What are the best practices for handling and transmitting these signals (e.g., should IP addresses be truncated or hashed)? How can I ensure that my system remains compliant with Apple’s App Tracking Transparency and other privacy guidelines? I’d appreciate any insights or references to relevant documentation that might help me build this system without getting rejected by Apple. Thank you in advance for your assistance!

I'm learning XPC by inspecting the GitHub Copilot project. I figured out that the schema works as follows: The host app with a UI to manage settings A Service Extension that controls the Xcode Editor A communication bridge cli app that connects the first two As far as I understand an app appears in the Accessibility Permission when it calls the next method: let key = kAXTrustedCheckOptionPrompt.takeRetainedValue() as NSString AXIsProcessTrustedWithOptions([key: true] as CFDictionary) This method is only called by the Service Extension. However, when I run a release build from the /Application folder (where launch agents point to), there are two records appearing in the Accessibility Permission list: The host app The needed Service Extension I compared all metadata files from Copilot with my copy line-by-line, but still can't figure out why the host app record appears in the Accessibility Permission, since the host app does not call the AXIsProcessTrustedWithOptions() method at all. Could you give me any clue to help me wrap my head around it?

Hello, I'm trying to publish my app, but I'm constantly getting rejected by Apple. They're telling me I'm having issues with tracking user data. This item has been rejected for the following reasons: 5.1.2 Legal: Privacy - Data Use and Sharing I've indicated that I don't use this data for ads, that it's only used for personalization and to understand who saves items. I added the NSUserTrackingUsageDescription property to the info.plist. I run AppTrackingTransparency.requestTrackingAuthorization() when the user logs into the app, displaying a warning message. I'd say I meet all the requirements they've set for me, but they still haven't approved my app. What do you recommend? How can I speak to a physical person who can help me? Thank you very much and best regards.

We're experiencing an issue with Local Network Permission. When trying to connect to a socket, the Local Network Permission alert pops up. To trigger the permission request at the start of the app, we used the following code to ask for permission and receive a callback on whether it's granted. However, this approach doesn't always trigger the permission alert, or it gets automatically dismissed after 30 seconds, only to reappear later. What could be causing this inconsistent behavior? func checkLocalNetworkPermission(_ completed: Optional&lt;(Bool) -&gt; Void&gt; = .none) { DispatchQueue.global(qos: .userInitiated).async { let hostName = ProcessInfo.processInfo.hostName let isGranted = hostName.contains(".local") if let completed { DispatchQueue.main.async { completed(isGranted) } } } }

Hello guys i have a problem. I have one template package. and I publish many applications using this package. i change only names and colors. my other other project working fine , there is no problem. But I get this error on new one of them. My PrivacyInfo like this and my copy bundle resources like this i cant handle this problem . please help

In TN3179 under "macOS considerations" there are a set of instances where local network privacy does not apply: macOS automatically allows local network access by: Any daemon started by launchd Any program running as root Command-line tools run from Terminal or over SSH, including any child processes they spawn I am running some tests in my app that use the local network, attempting to run them from both the terminal app and from a VScode terminal and I am getting permissions prompts. After allowing these pop ups, some of the tests still fail as if networking was blocked.

Hi! I use Tips with CloudKit and it works very well, however when a user want to remove their data from CloudKit, how to do that? In CoreData with CloudKit area, NSPersistentCloudKitContainer have purgeObjectsAndRecordsInZone to delete both local managed objects and CloudKit records, however there is no information about the TipKit deletion. Does anyone know ideas?

I want to hide some sensitive information when app is visible in the list of process on iOS. I observed that privacySensitive() modifier is not working for my app in case when view is embedded in UIHostingController. I works correctly for pure SwiftUI app. Can someone confirm this?, any workaround to make it working for my case.

It has been asked several times in the forum, but apple has always maintained that screenshot capture prevention is not supported, how is it that whatsapp and several financial apps are doing it, if screenshot capturing is not possible, its not DRM, is it the adding of a secured text as a layer on to the uiview layer? how have they designed a custom screen if that is the case? Also how is it getting approved by apple! If detection of airplay is possible and can be suppressed, why not screenshot?

Hello Apple Developer Team, I would love to see iCloud Keychain Autofill and Touch ID support extended to Chromium-based browsers on macOS (such as Ecosia, Brave, or Vivaldi). Currently, Safari allows autofill of passwords using Touch ID, but when using other browsers, I have to manually copy-paste credentials from Keychain Access, which is time-consuming. Would it be possible for Apple to provide an API or framework that allows non-WebKit browsers to integrate iCloud Keychain autofill while keeping security intact? This feature would make macOS more convenient for users who prefer alternative browsers while keeping security standards high. Thanks in advance for considering this! Best regards, Kilian

Hello, Our app has already received approval for using the Family Controls API. However, when we added an extension, we were informed that an additional approval was required. Unfortunately, our request was rejected. Apple Support advised us to include "Describing use of required reason API" in the privacyInfo file, but after reviewing the documentation, we couldn't find any relevant information specifically for the Family Controls API. Questions: How should we describe the use of Family Controls API in the privacyInfo file? What does the rejection reason "Enterprise use not approved" specifically mean? Why is additional approval required for the extension, and how can we resolve this? Background: Initial Approval: Our app was approved to use the Family Controls API. Extension Submission: We submitted an extension requiring additional approval, but it was rejected. Follow-up Inquiry: Apple Support instructed us to include a description in privacyInfo, but no relevant details for Family Controls API were found. Further Inquiry: We asked for clarification, and Apple Support referred us to DTS. DTS Response: They requested that we post our question on the Apple Developer Forums before they can review it. If anyone has insights, guidelines, or previous experience with this approval process, we would greatly appreciate your help. Thank you!