WWDC 2023 privacy manifests and what they mean for ad SDKs
Apple announced privacy manifests, required reason APIs and SDK signatures. The rules are not final, but app marketers can start by asking their SDK vendors the right questions.
At WWDC this week Apple announced a set of App Store changes aimed at third-party SDKs: privacy manifests, declared reasons for certain APIs, and signatures that verify who built an SDK. None of this changes App Tracking Transparency, and Apple has not yet said when the new requirements will be enforced. But the direction is clear enough that anyone buying app installs should start asking questions now.
What Apple announced
According to Apple's developer news post, privacy manifests are files that describe the privacy practices of a third-party SDK's code in a standard format. When a developer prepares an app for distribution, Xcode combines the manifests from all the SDKs into a single report, which Apple says should make the privacy nutrition labels easier to complete accurately.
Two further pieces came with it.
- Required reason APIs. Apps that call APIs that could be used for fingerprinting must pick an allowed reason for each API and declare it in the privacy manifest. Apple says developers must describe their usage accurately and may only use those APIs for the reasons they declared.
- SDK signatures. When a developer adopts a new version of a third-party SDK, Xcode validates that it was signed by the same developer. Apple frames this as protecting software supply chain integrity.
Apple said it would share more later this year, including a list of privacy-impacting SDKs, a list of the required reason APIs, a feedback form for proposing additional reasons, and documentation on signatures, privacy manifests and when they will be required. That last item is the one to watch. Until it is published, anything you read about an enforcement date is a guess.
The detail that matters for ad measurement
Singular's write-up of the session adds that apps can declare tracking domains in their manifest. Per that account, if a user has not granted tracking permission through App Tracking Transparency, network requests to the declared tracking domains fail. The practical suggestion in that article is for SDK vendors to separate their endpoints, so that privacy-safe traffic such as SKAdNetwork-related calls does not share a domain with calls that depend on tracking consent.
That is a meaningful design change for attribution and ad SDKs, and it is a reminder that "uses an identifier" and "tracks" are defined by Apple, not by the vendor. Singular also notes that ATT itself is not changing in iOS 17.
What a marketer should do now
You probably do not write the SDK code, but you decide which SDKs go into your app and which vendors you pay. Three steps are worth taking in the next few weeks.
- Inventory. Ask your developers for a list of every third-party SDK in the app: attribution, analytics, ad networks, deep linking, crash reporting. Include the version numbers. You cannot judge your exposure without it.
- Ask each vendor two questions. Do you plan to ship a privacy manifest and sign your SDK? And will you declare tracking domains, and how will your service behave if requests to them are blocked? Get the answer in writing and note the date.
- Find the soft spots. Rank the SDKs by how much your measurement depends on them. A vendor that stays silent on a critical SDK is a reason to start looking at alternatives, though not yet to switch.
What not to do
Do not rush to remove SDKs on speculation, and do not assume your attribution will stop working. Apple has said that more details are coming, and the enforcement date matters for how much urgency is justified. Equally, do not wait until your app update is rejected to learn which of your vendors was ready.
It also helps to separate two concerns that are easy to blur. The manifest and signature requirements govern what the app discloses and what gets verified at submission. Whether a given measurement method works for your campaigns is a separate question, and it depends on user consent and the vendor's design. Plan for both, but do not treat one as the answer to the other.
The takeaway: put the SDK inventory and the two vendor questions on your calendar this month, then revisit when Apple publishes the dates and lists it promised for later this year.