In force since
The number of days is calculated in your browser from today’s date.
App Store
Who is concerned
Developers of iOS, iPadOS, tvOS, visionOS and watchOS apps, and the authors of the third-party SDKs those apps use.
What changes
- Required reason APIs are APIs that could be misused to identify a device or user, a practice called fingerprinting. Fingerprinting is not allowed even when users do not give your app permission to track.
- Add a dictionary per API category to the
NSPrivacyAccessedAPITypesarray of the privacy manifest, with the category and the approved reasons. - If you use the API in your app’s code, report it in your app’s manifest. If it is in a third-party SDK’s code, the SDK’s own manifest must report it. An SDK cannot rely on the manifests of the apps that link it.
- Each executable or dynamic library that uses a required reason API needs a bundle that includes a privacy manifest reporting it.
- Declared reasons must be consistent with the app’s functionality as presented to users, and you may not use the APIs or the derived data for tracking.
- If you upload an app that uses a required reason API without a reason in its manifest, Apple sends an email that reminds you to add it.
What to do
- List the required reason APIs that your code and your SDKs call. Apple documents the categories and the allowed reasons.
- Add the reasons to your app’s privacy manifest and check that each SDK ships its own manifest.
- Test an upload to App Store Connect well before your release date.
What happens after the date
Apple’s documentation says that since May 1, 2024 apps that do not describe their use of required reason API in their privacy manifest file are not accepted by App Store Connect. Apple says it continually reviews the list of APIs and reasons and updates the article from time to time.
Frequently asked questions
Which APIs are covered?
Apple documents the categories, the APIs in each category and the reasons you can declare in the documentation for the dictionary keys, and updates it from time to time.
Do SDKs need their own manifests?
Yes. A third-party SDK cannot rely on the privacy manifests of the apps that link it or of other SDKs, so it reports its own use of required reason APIs.
Is this the tracking permission prompt?
No. Apple says fingerprinting is not allowed regardless of whether a user gives your app permission to track.
Official sources
Every date and rule on this page comes from the official pages below, read on 2026-11-02. We do not estimate dates or predict enforcement.