Implementing Apple Privacy Manifest and SDK Signing for iOS Apps

1. Background

Apple announced two new privacy‑related features on 2023‑06‑05: the Privacy Manifest and SDK signing. A later update on 2023‑12‑07 stated that starting Spring 2024, any new app or app update that includes a third‑party SDK must provide a corresponding privacy manifest, and binary SDKs must be signed. On 2024‑02‑29 Apple added two enforcement dates: from March 13, apps using APIs that require a justification will receive an email if the justification is missing; from May 1, developers must supply justifications for all listed APIs before uploading a new app or update.

2. Privacy Manifest and SDK Signing

2.1 What the Manifest File Is

The privacy manifest allows third‑party SDKs or apps to list the data they collect and describe the APIs that need a justification. Official documentation: Privacy Manifest . List of required third‑party SDKs: Third‑Party SDK Requirements .

2.2 Filling the Privacy Manifest

The manifest file must be created with Xcode 15; the UI is shown in the original document.

After creation, fill the key‑value pairs according to the project’s needs, selecting values from the predefined options.

Explanation of key‑value pairs in the manifest:

Key

Description

NSPrivacyTracking

Boolean indicating whether the app or third‑party SDK uses data defined under the App Tracking Transparency framework.

NSPrivacyTrackingDomains

A set of strings listing internet domains involved in tracking. If tracking is enabled, at least one domain must be provided; otherwise, zero or more domains are allowed.

NSPrivacyCollectedDataTypes

A set of dictionaries describing the types of data collected by the app or SDK. See the manifest documentation for the required keys and values.

NSPrivacyAccessedAPITypes

List of APIs that require a justification; fill according to the “APIs that need a reason” section.

APIs that require a justification include File timestamp APIs, System boot time APIs, Disk space APIs, Active keyboard APIs, and User defaults APIs.

2.3 SDK Signing

Binary third‑party SDKs must be provided with a signature. Xcode verifies that the SDK is signed by the same developer, improving the software supply‑chain integrity.

Signatures can be Apple Developer Program signatures or self‑signatures. If a signed SDK’s signature changes, Xcode will fail the build and display a warning.

2.4 How to Sign an SDK

Typical command‑line workflow:

# 1. Search for the _CodeSignature directory in a given path
find -name -type d "_CodeSignature"
# 2. List local code‑signing certificates
security find-identity -v -p codesigning
# 3. Sign the SDK (see Apple WWDC 2023 session 10061)
codesign --timestamp -v --sign "Your Certificate Name"

Replace </path/to/SDK.framework> with the actual SDK path. Verify the signature with:

codesign -dvvv

3. What Apple Does After Adaptation

Providing a privacy manifest helps developers understand how third‑party SDKs use private data and APIs. Developers can merge SDK manifests in Xcode, export a PDF report, and use it as a reference when filling privacy labels for App Store submission. The privacy labels appear on the App Store product page for users.

Apple will review the usage of APIs that require a justification; missing justifications will trigger email notifications (from March 13) and block app submission (from May 1).

Reference articles:

iOS 17 Privacy Manifest – https://www.smaato.cn/blog/ios-17-privacy-manifests-sdk/

2024 Spring iOS Privacy Manifest – https://juejin.cn/post/7311876701909549065

iOS 17 Privacy Agreement Detailed Adaptation – https://juejin.cn/post/7329732000087425064?from=search-suggest

Understanding Apple’s App Tracking Transparency – https://www.zhihu.com/question/453556827/answer/1859655554