App Privacy Submission Deadline: May 1 – Latest News
Apple Enhances App Privacy with new SDK Requirements
Table of Contents
Background: Increased Scrutiny of Third-Party SDKs
Apple is strengthening its privacy protections for users by increasing scrutiny of third-party Software Progress Kits (SDKs) used within apps. These SDKs,often including code frameworks and libraries from external sources,can access user data and impact app security. To address these concerns, Apple is implementing new requirements for developers regarding transparency and security.
New Requirements Effective May 1, 2024
Begining May 1, 2024, new apps and updates to existing apps incorporating newly added third-party SDKs from apple’s list of commonly used third-party SDKs must adhere to the following:
- Required API Usage Reasons: Developers must provide a justification for each listed API accessed by the SDK.
- Privacy Manifests: Submission of Privacy manifests is mandatory.
- Valid Signatures: SDKs added as binary dependencies require valid signatures.
Apps failing to meet these requirements will be rejected from the App Store. Specifically,apps will be rejected if they lack a reason for a listed API,the code resides within a dynamically embedded framework (using the Embed Frameworks build phase),and the framework is a newly added SDK from the specified list.
Future Expansion of Requirements
Apple plans to extend these “required reason” requirements to encompass the entire app binary in the future. Developers are encouraged to proactively evaluate their API usage and find alternatives if they lack an approved reason for accessing specific data. This proactive approach will ensure future compliance and minimize disruption during the rollout of the expanded requirements.
Why These Changes Matter
These changes are designed to provide users with greater transparency regarding how third-party SDKs utilize their data. By requiring developers to justify API usage and secure software dependencies, Apple aims to bolster user privacy and enhance the overall security of the App Store ecosystem. The initiative also encourages SDK providers to adopt these practices, benefiting all apps that rely on their services.
Impact on Developers: A Checklist
- Review SDK Integration: Identify all newly added third-party sdks.
- Document API usage: For each listed API accessed by these SDKs, clearly document the reason for its use.
- Generate Privacy Manifests: Create and submit the required privacy manifests.
- verify Signatures: Ensure valid signatures are in place for binary dependencies.
- Consider Alternatives: If an API lacks an approved reason,explore alternative solutions.