PrivacyInfo.xcprivacy missing: why the upload is rejected
A privacy manifest is a PrivacyInfo.xcprivacy file in your app target. It is required once your app, or an SDK you bundle, uses a Required Reason API or collects data. App Store Connect rejects uploads that use Required Reason APIs without declaring them, so this fails before review.
Why it matters
The manifest is a property list describing three things: the data types the app collects, the Required Reason APIs it uses along with an approved reason for each, and the domains it contacts for tracking.
It is not required of every app. It becomes required when there is something to declare, which in practice means almost any app with an analytics, advertising, attribution or crash SDK, and any app that reads file timestamps, system boot time, available disk space, the active keyboard list or user defaults.
A file that exists but contains none of the expected keys is its own problem: it parses, it ships, and it declares nothing, which is the same position as having no manifest while looking like compliance.
Third-party SDKs ship their own manifests, and those do not replace yours. Yours describes your app; theirs describes them. What the SDK collects still has to be reflected in your App Privacy answers in App Store Connect.
How to fix it
- Add a file named PrivacyInfo.xcprivacy to the app target, as an App Privacy Configuration File, and confirm it is a member of the target rather than only present in the project.
- Declare NSPrivacyAccessedAPITypes for each Required Reason API category your app or its SDKs use, each with an approved reason code.
- Declare NSPrivacyCollectedDataTypes for the data the app collects, including what your SDKs collect on your behalf.
- Set NSPrivacyTracking and NSPrivacyTrackingDomains if anything in the app tracks users across apps or websites.
- Keep it in step as you add SDKs. A manifest written once at submission and never revisited is a manifest that stops being true at the next dependency update.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
What ReviewAhead checks
Privacy manifest. Apps that collect data or use Required Reason APIs need PrivacyInfo.xcprivacy.
- Whether a manifest is required, by looking for Required Reason API usage and data-collecting SDKs in your project.
- Whether PrivacyInfo.xcprivacy is present when it is required.
- Whether a present manifest parses and carries the keys a manifest is supposed to have.
- Reports how many Required Reason declarations and collected data types it found, so you can compare against what you expected.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.