What are privacy manifests?

What problem they address

An app's privacy disclosures are the developer's responsibility, but a large share of the data collection in a typical app happens inside third-party SDKs the developer did not write and cannot easily inspect.

Developers were therefore attesting to behaviour they could not verify. Privacy manifests push the declaration to the party that actually knows: each SDK ships a machine-readable file describing what it collects and why, and the app's overall disclosure is assembled from its own manifest plus those of its dependencies.

What a manifest declares

• Data types collected, from Apple's defined taxonomy.
• The purpose of each collection.
• Whether the data is linked to identity or used for tracking.
• Required-reason API usage — certain APIs that could enable fingerprinting need a declared, approved justification.
• Domains contacted, so network behaviour is disclosed.

What it means in practice

For app developers: an SDK without a valid manifest can block a submission, so dependency hygiene has become a release-blocking concern rather than a background one. Auditing what your SDKs declare is also a fast way to discover collection you did not know was happening.

For SDK vendors: the manifest is a public, machine-readable statement that can be compared against observed behaviour, which raises the cost of quiet over-collection considerably.

The broader effect is that the Privacy Nutrition Label a user sees is now assembled from verifiable declarations rather than from a developer's best guess.