App Privacy declaration: the requirement most often missed
App Privacy is the nutrition label on your product page, and it has to cover every data type your app collects, including everything collected by the SDKs you bundle. It is a required property for every app, and it is the one no API can read back, so nothing can check it for you.
Why it matters
Each data type is classified as one of three things: used to track you, meaning it is linked to third-party data for advertising or shared with a data broker; linked to you, meaning it is associated with the user’s identity; or not linked to you, meaning it cannot be tied back to them.
The categories are contact info, health and fitness, financial info, location, sensitive info, contacts, user content, browsing history, search history, identifiers, purchases, usage data, diagnostics, surroundings, body, and other data.
Third-party SDK collection counts as yours. Data an analytics, advertising, attribution or crash SDK collects has to appear in your declaration, which is the part most often missed because the SDK is the one doing it.
Anything classified as used to track you also requires NSUserTrackingUsageDescription and an App Tracking Transparency prompt, so the declaration and the app’s behaviour have to agree.
How to fix it
- List every SDK the app ships, including the ones that arrived transitively.
- For each, read the vendor’s documentation of what it collects and map it onto Apple’s data type categories.
- Add your own collection to the same list, then complete the App Privacy section in App Store Connect against the whole set.
- Check the classification on each: linked, not linked, or used to track, since getting the category right and the classification wrong is still wrong.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
What ReviewAhead checks
App Privacy declaration. Every data type you and your SDKs collect must be declared in App Store Connect.
- Uses the SDK inventory from your project to say which data types you will have to declare.
- Asks whether the declaration covers them, because there is no app privacy resource in the App Store Connect API at any version: this is the one question the API cannot answer.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.