Does your privacy policy cover the SDKs you bundle?
Data a third-party SDK collects counts as data your app collects. It has to appear in your privacy policy and in your App Privacy answers, and the SDK shipping its own privacy manifest does not discharge that: theirs describes the SDK, yours describes your app.
Why it matters
This is the obligation people are most often surprised by, because the SDK is doing the collecting and its documentation describes what it collects. From Apple’s side the app is the product on the store, so the declaration is the app’s.
It applies to the categories most apps bundle without thinking of them as data collection: analytics, crash reporting, attribution, advertising, authentication, payments and backend SDKs.
A privacy policy written before the last two dependencies were added is the usual state of affairs. Nothing prompts you to revisit it, and nothing fails until a reviewer compares your nutrition label against what a known SDK is known to collect.
How to fix it
- List the SDKs the app actually ships, including transitive dependencies that come in with something else.
- For each, read what the vendor documents as collected, and check it appears in your privacy policy in terms a person can match to it.
- Check the same data types are declared in App Privacy in App Store Connect, with the right linked, not linked or tracking classification.
- Revisit this whenever a dependency is added or upgraded, rather than only before a submission.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
What ReviewAhead checks
SDK privacy disclosure. Bundled SDKs collect data that must appear in your privacy policy and nutrition label.
- Which recognised SDKs the project bundles, by category.
- Asks whether your privacy policy covers what they collect, because a policy lives at a URL and ReviewAhead contacts no URL it is given.
- Names the SDKs it found, so the question is about your actual dependency list rather than a generic prompt.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.