Data-collecting SDKs missing from the privacy manifest
The collected data types in your privacy manifest have to account for what bundled SDKs collect on your behalf. A manifest that lists only what your own code gathers is incomplete in the way that is hardest to notice, because everything in it is true.
Why it matters
Each recognised SDK maps to the data types it is known to collect. An analytics SDK collects usage data and identifiers; an advertising SDK adds more; a crash reporter collects diagnostics. Those are your declarations to make.
The manifest and the App Privacy answers in App Store Connect are two declarations of the same facts, in two places, and they have to agree with each other and with what the app does.
This is graded as a risk rather than a blocker because the mapping from SDK to data types is knowledge about the SDK rather than something read out of your project, and a check that cannot prove itself should not be presented as proof.
An SDK shipping its own privacy manifest does not remove the obligation. Apple merges SDK manifests into the privacy report for the app, which is a description of what happens, not a declaration on your behalf: yours still has to describe what your app collects, including through them.
The gap is easiest to create by subtraction. A manifest written accurately when the app had two dependencies stays accurate-looking after the third is added, because nothing in it became false, it just stopped being complete.
How to fix it
- Read the data types listed for each SDK you bundle in the report, and compare them against NSPrivacyCollectedDataTypes in your manifest.
- Add any that are missing, with the right linked and tracking flags for how that SDK uses them.
- Mirror the same set in App Privacy in App Store Connect.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
What ReviewAhead checks
Collected data declarations. Data-collecting SDKs must be reflected in the privacy manifest.
- The data types your privacy manifest declares.
- The data types the SDKs in your dependency graph are known to collect.
- The gap between the two, named SDK by SDK, so the fix is a list of additions rather than a prompt to go and check.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.