Third-party SDKs your app ships, and what you must declare
An inventory rather than a verdict. Each SDK you bundle collects something, and what it collects has to be reflected in your App Privacy answers in App Store Connect, even when the SDK ships its own privacy manifest.
Why it matters
Dependencies arrive transitively. An SDK you chose brings two you did not, and those collect data on your behalf just as directly.
The categories that matter for privacy declarations are analytics, advertising, attribution, crash reporting, authentication, payments, backend and social. A dependency in any of them puts data types on your nutrition label.
This is reported as an improvement rather than a problem because the inventory itself is not a defect. It is the input to the two checks that are: your privacy manifest declarations, and your App Privacy answers.
It is also the list that goes out of date fastest. A dependency upgrade can add a data type without changing a line of your code, and nothing in the upgrade tells you that your nutrition label is now incomplete.
The list is worth reading even when the declarations are correct, because it is a description of what your app talks to. An analytics SDK you stopped using but never removed is still in the binary, still collecting, and still yours to declare.
How to fix it
- Read the list and confirm it matches what you think you ship. An SDK you do not recognise came in transitively and is worth tracing.
- For each one, check what the vendor documents as collected and make sure the App Privacy nutrition label lists those data types.
- Remove SDKs you no longer use. Every one you drop is a set of declarations you no longer have to keep true.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
What ReviewAhead checks
Recognised third-party SDKs. Bundled SDKs are inventoried so their privacy obligations are visible.
- Recognised SDKs in your dependency graph, grouped by category.
- Reads Swift Package Manager and CocoaPods manifests as text, never evaluating them.
- Maps each recognised SDK to the data types it is known to collect, which is what makes the inventory actionable rather than a list of names.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.