Issue 614  June 16th 2023

Did you spot this Apple developer news article on privacy and app integrity published last week during WWDC? It includes information and links to two upcoming features, privacy manifests and “required reason” APIs. There’s a great session video from WWDC, which I’d highly recommend watching to get you up to speed with both.

Privacy nutrition labels on the App Store were a step forward for how informed people could be about what an app is doing with their data, but I’d also bet that a non-trivial amount of them are incorrect in some way. 😬 In the vast amount of cases, I’d expect that to be caused by the inclusion of third-party SDKs.

Privacy manifests aim to fix that problem by allowing package authors to include privacy information in each package, and Xcode 15 has a feature to gather those together for every SDK in your app. Won’t it be great when we don’t need to dig through third-party documentation (or even make guesses from a privacy policy!) to figure out what a vendor is doing or, even better, decide whether to use an SDK? 🎉

Even better, the post also says these manifests will eventually become required. They don’t go into any detail (that I could see) about when or precisely what this means, but I’d expect it to be a pre-flight check when uploading an app to the store.

But that’s not everything, and tucked away at the bottom of the news post was a little note that says everything about how seriously Apple think about this. They say that later this year, they’ll publish “a list of privacy-impacting SDKs (third-party SDKs that have particularly high impact on user privacy)”. I have no idea what they’ll publish or how they will distribute it, but that’s a clear sign that they are a company on the warpath!

Of course, we’re already considering how we will integrate privacy manifest data into package pages on the you-know-what. 👍

Dave Verwer