Understanding Apple’s new announcement called ‘Privacy Manifests’

The Apple Worldwide Developers Conference made some announcements about privacy the day before yesterday, on 5th June 2023.

They introduced something called Privacy Manifests, a way for developers to understand how third-party code in an app uses data.

At this point, it’s crucial to grasp the concept of fingerprinting. Let me simplify it with a few easy examples.

Let’s imagine a situation where you have a popular app on Apple Store; let’s call it a “Fun Game App.” This app wants to make money through ads, so they partner with an ad tech company called “AdTechMaster.”

When you use the Fun Game App, AdTechMaster wants to track your behaviour and collect information about you to show you personalized ads. 

They do this by using a method called fingerprinting

AdTechMaster creates a unique profile of your activities within the Fun Game App, such as the games you play, the items you purchase, or the videos you watch.

It is important to note that all this tracking and fingerprinting is happening within the Fun Game App itself.

It’s like AdTechMaster is a guest inside the app, collecting data without directly involving Apple.

Apple, as the owner of the App Store, can see that AdTechMaster is conducting fingerprinting within the Fun Game App during the app review process.

However, if Apple wants to stop this fingerprinting practice, they would have to take action against the Fun Game App and potentially reject updates or even remove it from the App Store.

But punishing the Fun Game App for the actions of AdTechMaster would be unfair.

The app developers themselves may not be involved in the fingerprinting or even aware of it, as they rely on the services of the ad tech company.

It would be like punishing the Fun Game App for something they didn’t directly do wrong, but rather the fault lies with the ad tech company they are working with.

This would create a problem because almost every app in the App Store relies on at least one ad tech company or software development kit (SDK) that performs fingerprinting.

The Privacy Manifest ( as described in this new documentation) is intended to help developers understand how third-party software development kits (SDKs) use data.

It involves creating files that describe the data collection and usage practices of these third-party SDKs in a standardized format.

When developers prepare to distribute their apps, Xcode will combine the privacy manifests from all the SDKs used into a comprehensive report.

This report will make it easier for developers to create accurate Privacy Nutrition Labels, which provide information about how apps handle user data.

This approach differs from what Android is doing, but it aims to make developers accountable for the data usage of third-party vendors.

It puts the app developers responsible for documenting how user data is used and ensuring compliance with Apple’s privacy policies.

Apple’s approach is administrative rather than technical, like Android’s SDK Runtime, which places the compliance burden on app developers.

It requires them to document the data usage of their third-party vendors and assumes liability for their actions.

The enforcement relies on good-faith descriptions from developers, which may be subject to gaming or manipulation.

It will be interesting to see how this administrative versus purely technical approach plays out and to what degree it can be gamed.

Insights