iOS Privacy for Developers: From the 2012 Address Book Uproar to Privacy Manifests

iOS · Privacy · App Store rules

Many of the privacy prompts iOS users see today trace back to specific incidents and policy changes. This article walks through the main milestones and what each one asks of developers.

February 2012: the Path address book incident

In early February 2012, developer Arun Thampi was building a desktop companion for the social app Path when he noticed that the app sent his whole address book, including full names, email addresses and phone numbers, to Path’s servers. He said he did not remember giving permission. Path’s chief executive Dave Morin replied that the upload was used to help people find friends on Path and to tell them when friends joined, and Path shipped an update that asked for permission first.

Path was not the only app doing this, but it became the example everyone pointed to. As Macworld’s review of 2012 notes, Apple announced in mid-February that a future iOS update would require apps to get the user’s permission before accessing contacts.

iOS 6: permission before contacts

Apple followed through with iOS 6. From then on, apps could read a user’s contacts only after the user approved a system prompt. The same pattern, a system-owned permission dialog with a developer-supplied explanation, now covers photos, location, the camera, the microphone and many other resources.

iOS 14.5: App Tracking Transparency

iOS 14.5, released on April 26, 2021, introduced App Tracking Transparency (ATT). Apps that want to track users across apps and websites owned by other companies, or to access the device’s advertising identifier, must ask through the AppTrackingTransparency framework first, and the user can say no. The choice can be changed later in Settings.

2024: privacy manifests and required reason APIs

Apple later asked apps and third-party SDKs to describe their data practices in a privacy manifest, a property list file named PrivacyInfo.xcprivacy. Apple also defined a set of “required reason” APIs that could be misused for fingerprinting, and apps must declare an approved reason for using them. From May 1, 2024, App Store Connect stopped accepting new and updated apps that did not describe their use of required reason APIs.

<!-- PrivacyInfo.xcprivacy (excerpt) -->
<key>NSPrivacyTracking</key>
<false/>
<key>NSPrivacyAccessedAPITypes</key>
<array>
  <dict>
    <key>NSPrivacyAccessedAPIType</key>
    <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
    <key>NSPrivacyAccessedAPITypeReasons</key>
    <array><string>CA92.1</string></array>
  </dict>
</array>

A practical checklist

  • Ask for a permission only at the moment a feature needs it, and write a clear purpose string in Info.plist explaining why.
  • Make the app usable when the user says no.
  • If you upload contacts or other personal data, say so plainly and collect only what the feature needs.
  • Request tracking permission with ATT before tracking, and respect the answer.
  • Keep your privacy manifest accurate, and check that each third-party SDK ships its own.
  • Re-read Apple’s user privacy and data use guidance before each major release.

Takeaway

Each rule above came from a real gap between what apps could do and what users expected. Designing for the prompts from the start is easier than retrofitting them later, and it also makes App Review smoother.

Sources