Tracking SDKs without NSPrivacyTracking or an ATT prompt
If your app bundles an SDK that tracks users across apps or websites, three things have to be true together: NSPrivacyTracking is set in the privacy manifest, the domains that tracking contacts are listed, and the app asks for permission through App Tracking Transparency before any of it happens.
Why it matters
Tracking has a specific meaning here: linking data about a user to third-party data for advertising, or sharing it with a data broker. Advertising and attribution SDKs generally do this by definition, which is why bundling one puts you in scope whether or not you think of your app as an advertising app.
NSPrivacyTracking set to true is the declaration. NSPrivacyTrackingDomains is the list of domains involved, and a declaration with an empty domain list is incomplete: iOS uses that list to block the connections when a user has declined.
The ATT prompt is the user-facing half, and it needs NSUserTrackingUsageDescription in Info.plist to appear at all. Without the prompt, tracking that happens anyway is the thing App Review looks for, and it is one of the reliable rejection reasons in this area.
The same data has to appear in your App Privacy answers in App Store Connect, classified as used to track you. The manifest and the product page are separate declarations of the same fact and they have to agree.
How to fix it
- Set NSPrivacyTracking to true in PrivacyInfo.xcprivacy if any bundled SDK performs advertising or attribution tracking.
- List every domain that tracking contacts in NSPrivacyTrackingDomains. The SDK vendor documents these.
- Add NSUserTrackingUsageDescription to Info.plist and request authorization through ATTrackingManager before the tracking SDK starts.
- Make sure the tracking does not begin until the user has answered, including on first launch, which is where it most often leaks.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
What ReviewAhead checks
Tracking declaration. Tracking SDKs require NSPrivacyTracking, tracking domains and an ATT prompt.
- Which bundled SDKs are known to perform advertising or attribution tracking.
- Whether NSPrivacyTracking is set to true when they are present.
- Whether tracking domains are listed rather than left empty.
- Whether an App Tracking Transparency prompt appears anywhere in the source.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.