Phase 3: Native Development

App Tracking Transparency & privacy manifests (iOS)

Intermediate ~4 min read
Think of it this way A friendly analogy. Read this if the technical version feels dense. Show Hide

Imagine apps on your phone are like different board games you play. You might play Monopoly one minute, then switch to Ticket to Ride. Sometimes, one game might try to "peek" at what you did in another game – maybe Monopoly wants to know how many train routes you built in Ticket to Ride to give you a special bonus. This "peeking" is like tracking, where one app tries to collect information about what you do in other apps or on websites. Years ago, apps could do a lot of this peeking without asking. But then Apple introduced something called App Tracking Transparency (ATT), which is like a polite permission slip for your games.

Now, if a game wants to peek at your other game activities, it must pop up a little message asking, "Hey, this game wants to know about what you do in other games or on the internet. Is that okay?" You get to say yes or no. If you say no, the game just plays along happily without any extra peeking. This is super important because it gives you the power to decide what information games (or apps) can learn about your activities outside of that specific game. It helps keep your digital activities more private, so you’re not getting ads for things just because a game saw you clicked on something in a totally different app.

Building on that, sometimes games have little helper tools or expansion packs that come with them, right? Even those helpers might collect some info. That's where "privacy manifests" come in. Think of a privacy manifest as a special, clear "Game Information Card" that every game and every helper tool has to include. This card isn't just for permission; it's a full list that plainly tells you: "What specific pieces of information does this game (or helper) collect about you during play?" and "Why does it need that information?" For example, it might say, "This game collects your score to save your high score" or "This helper tool collects how many times you tap a button to make sure it's working properly."

So, when you're learning to build your own apps, these rules are super important. If your app wants to do any "peeking" at what someone does outside your app, you’ll need to politely show the App Tracking Transparency permission message first. And for every app you make, you'll need to create that special "Game Information Card" – the privacy manifest – to clearly write down what data your app collects and why. This way, the people using your app always understand exactly what’s happening, which builds trust and lets them feel safe playing your "game"!

Apple's App Tracking Transparency (ATT) framework is a cornerstone of user privacy on iOS, fundamentally changing how apps can track user activity. Introduced in iOS 14.5, ATT requires apps to explicitly ask for user permission before they can track users across other apps, websites, or offline properties. "Tracking" in Apple's definition involves linking user or device data collected from your app with data collected from other companies for purposes like targeted advertising or measurement. Before you can access the Identifier for Advertisers (IDFA) or engage in cross-app tracking, your app must present the ATT system prompt. This prompt's message is pre-defined by Apple, but you can provide a custom NSUserTrackingUsageDescription in your Info.plist file to explain why your app needs tracking permission.

Building on ATT, iOS 17 introduced privacy manifests, a new requirement designed to enhance transparency and provide users with a clearer understanding of how their data is handled. A privacy manifest is a PrivacyInfo.xcprivacy file bundled with your app and any third-party SDKs it uses. This file declares two critical things: first, how your app and its SDKs use specific "required reason APIs" (like File System APIs or User Defaults) and the justified reasons for their usage; and second, what types of user data your app (and its SDKs) collect, and whether that data is used for tracking. Apple uses these manifests to ensure developers are transparent about data practices, and they are critical for app review and approval.

For developers, the practical implications are significant. You must decide when to present the ATT authorization request to the user, ideally at a point where they understand the value exchange. If a user denies tracking, you must respect that choice and disable any tracking-related functionality. Furthermore, you are now responsible for ensuring that all third-party SDKs integrated into your app provide their own privacy manifests and adhere to Apple's tracking guidelines. Failure to comply with ATT or provide accurate privacy manifests can lead to app rejection during the review process. Ultimately, these measures are about fostering user trust by giving individuals more control and visibility over their personal data.

Key Takeaways

  • App Tracking Transparency (ATT) requires explicit user consent via a system prompt before your app can track users across other apps or websites.
  • A PrivacyInfo.xcprivacy file (privacy manifest) declares how your app and its SDKs use specific APIs and what user data they collect for tracking.
  • You must provide a NSUserTrackingUsageDescription in your Info.plist to explain your app's reason for requesting tracking permission.
  • Always request ATT authorization before attempting to access the IDFA or engaging in cross-app tracking activities.
  • Ensure all third-party SDKs you integrate provide compliant privacy manifests and respect user tracking preferences to avoid app rejection.

Code Example

swift
import AppTrackingTransparency
import AdSupport

func requestTrackingAuthorization() {
    if #available(iOS 14, *) {
        // Check current authorization status
        let status = ATTrackingManager.trackingAuthorizationStatus
        if status == .notDetermined {
            // Only request if not yet determined
            ATTrackingManager.requestTrackingAuthorization { status in
                switch status {
                case .authorized:
                    print("Tracking authorized. IDFA: \(ASIdentifierManager.shared().advertisingIdentifier)")
                case .denied, .restricted:
                    print("Tracking denied or restricted.")
                case .notDetermined:
                    print("Tracking status not determined after request.")
                @unknown default:
                    break
                }
            }
        } else {
            print("ATT status already set: \(status)")
        }
    } else {
        print("ATT not applicable on iOS versions prior to 14.")
    }
}

// Call this function when appropriate in your app's lifecycle,
// for example, after an initial user education screen, but before
// any tracking functionality attempts to operate.

How this code works

This Swift code is designed to implement Apple's App Tracking Transparency (ATT) framework. Its primary job is to politely ask users for permission to track their activity across different apps and websites for advertising purposes. This consent is crucial for apps that intend to use the Identifier for Advertisers (IDFA) to personalize ads, ensuring compliance with Apple's privacy guidelines.

The requestTrackingAuthorization function first ensures the device runs #available(iOS 14, *) or later, as ATT is a newer feature. Inside, it uses ATTrackingManager.trackingAuthorizationStatus to check the current permission state. Crucially, the code only calls ATTrackingManager.requestTrackingAuthorization if the status is .notDetermined. This subtle but important order-of-operations prevents bombarding users with repeated prompts if they've already made a choice, either granting or denying tracking. Once the request is made, the completion handler with the switch status statement processes the user's decision, logging whether tracking was authorized (and revealing the IDFA via ASIdentifierManager.shared().advertisingIdentifier), denied, or restricted. This ensures the app respects the user's privacy choices and adapts its behavior accordingly.

Related Articles

Hand-picked reads to go deeper on permissions & privacy.

Back to Mobile Developer Roadmap