Understanding Apple’s new Privacy Manifest Rules

Question

Created Apr ’24

Replies 0

Boosts 0

Views 1.6k

Participants 1

Greetings everyone, first of all I apologize to everyone for the long question I am going to ask, but I thought it would be better to tell you my question and what I am working on to solve it.

You may have heard about Apple's new Privacy Manifest requirement for new apps to be released to the app store. After I heard about it, I made a list of all dependencies used in my project and then updated them to the versions that include the Privacy Manifest file. Since I only use UserDefaults in my project, which is one of the required reason APIs specified by Apple, I added it and my reason for using it in the Privacy Manifest file.

When I released a package with this development, I received a new notification email from Apple saying that while they used to be upset with me about UserDefaults, they are no longer, so it seems that Apple has accepted my reason for using UserDefaults in the application.

However, Apple was also upset about Required Reason APIs in this list that I don't actually use (e.g. SystemBootTime API, DiskSpace API, FileTimestamp API).

I thought about what could be causing this.

First of all, it could be that one of the dependencies I use didn't specify the Required Reason API in the Privacy Manifest file or specified it incorrectly.
- However, I didn't think this was likely because I'm using common dependencies (e.g. Firebase, Alamofire, Lottie, etc.) and I didn't find any issues in the repos for them.
Then it occurred to me that we have a binary dependency embedded statically in the project. I looked at the repo of this dependency and in the latest versions they added the Privacy Manifest file, but they added an empty privacy manifest file.
- This SDK is actually a service that we bought as a company. Therefore, I don't think there will be a problem. If they don't use Required Reason API, I think it can't be the cause of the mail. Nevertheless, our Business Analysts will contact the SDK owners.
Then I realized that although it is on the list of SDKs that Apple requires to include a privacy manifest, I could not update it. This is nanopb. Actually, this is not a direct dependency of mine, but it is a dependency of Firebase.
- Like nanopb, there are other packages that are dependent on Firebase and are listed by apple (e.g. abseil, Promises, GTMSessionFetcher etc.) These are included as SPMs in the Package.swift file of Firebase that I have added to my project, with specific version ranges. If I update it, I get the latest version of the appropriate SPM version.

For example promises were added for Firebase 10.16.0 as follows. The previous version did not have the Privacy Manifest. So I updated it to 2.4.0 by doing Project Navigator > Package Dependencies > Update To Latest Package Versions on Xcode.

.package(
      url: “https://github.com/google/promises.git”,
      “2.1.0” ..< “3.0.0”
    ),

This version included the Privacy Manifest, which solved my problem. But for nanopb the situation is as follows and no version of nanopb provides Privacy Manifest. I'm not even sure if there is a version of nanopb like the one below.

.package(
      url: “https://github.com/firebase/nanopb.git”,
      “2.30909.0” ..< “2.30910.0”
    )

When I did some research on the issue, I came across something like this.

The Google developer wrote “This bug can be closed because this repo does not release a binary distro of nanopb for Apple platforms.” in response to the issue.

But as a non-native English speaker, I don't understand this explanation.

As a result, Apple stated in the mail that I was using these Required Reason APIs (I will give an example of the mail below). I tried to find it even though it was not the case. Three possibilities came to my mind and I thought about these possibilities.

Finally, I decided to consult you

What do you think is causing this (is it widely used sdk's that do not specify or incorrectly specify the reason for using required reason api's? is it static library? is it nanopb?)
Is there any way to see Apple's evaluation in this notification email without releasing the package? Will I test whether I have fixed this or not by constantly releasing packages?

Any comments will be very appreciated. Thank you very much in advance for all your comments and answers!

Email (Consider that the equivalent exists in the SystemBootTime API and DiskSpace API below.):

ITMS-91053: Missing API declaration - Your app’s code in the “MyAppName” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryFileTimestamp. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api

Boost