Content Filter Permission Prompt Not Appearing in TestFlight

What platform is this for?

I suspect you’re targeting iOS, in which case you’re probably hitting the deployment limit for content filters on that platform. TN3134 Network Extension provider deployment discusses that.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hi,

I have the exact same issue and have followed the minimum iOS Deployment. I set it to 17 for now. But the issue still happens

Again, the key reference here is TN3134 Network Extension provider deployment.

I set it to 17 for now.

I’m not talking about the deployment target (the OS version), but rather the deployment channel (Development, Ad Hoc, or App Store, including TestFlight).

TN3134’s focus on deployment leads to an important subtlety that it doesn’t cover. During development, iOS allows you to save a NE filter configuration using NEFilterManager. This allows you to develop your content filter without messing around with configuration profiles. However, that affordance isn’t enabled during deployment, at which point you have to follow the rules in TN3134.

Network Extension determines whether your app is Development or Distribution sign based on the get-task-allow entitlement (com.apple.security.get-task-allow on macOS, get-task-allow on other platforms).

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Do you mean that I need to add that line on my entitlements? I can't find the explanation on the link you shared TN3134: Network Extension provider deployment | Apple Developer Documentation Can you give me the step by step process?

Do you mean that I need to add that line on my entitlements?

I presume you’re referring to the get-task-allow entitlement. If so, then no, that’s not what I mean. That entitlement is managed by Xcode. It automatically adds it when you sign for development and omits it out when you sign for distribution.

Let’s ignore development signing for the moment, because shipping apps are necessarily distribution signed. In that case, you have the three options outlined by TN3134:

• On supervised devices, the device manager can install a configuration profile that enables your content filter system wide.
• On managed devices, the device manager can use MDM to install a configuration profile that enables your content filter for specific managed apps, also installed by MDM.
• If you’re building a Screen Time app, your app can programmatically enable its content filter. This is subject to very specific criteria, outlined in the Deploying a content filter provider section of TN3134.

Those are your only options. You can’t build a content filter that works on arbitrary devices without Screen Time restrictions.

If your goal is to target arbitrary devices, I recommend that you explore URL filter instead. We talked about that in great detail in WWDC 2025 Session 234 Filter and tunnel network traffic with NetworkExtension.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

How about NEDNSProxyProvider or NEFilterDataProvider? Can we use that? The URL Filters only support iOS 26+ right?

How about NEDNSProxyProvider … ?

That’s covered by the Deploying a DNS proxy provider section of TN3134 .

How about … NEFilterDataProvider?

NEFilterDataProvider and NEFilterControlProvider always comes as a pair [1]. Collectively they form a content filter, which is what we’ve been discussing here. You can’t have just a data provider.

The URL Filters only support iOS 26+ right?

Correct.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] On iOS. The rules for content filters on macOS are very different, and one of the key changes is that there’s data/control provider separation.

Hi

Is there any resources that I can read and follow, like a guide. I checked this sample but the build failed https://developer.apple.com/documentation/networkextension/filtering-traffic-by-url