What to account for
Decide whether the activity is tracking
Apple includes linking app and third-party data for targeted ads or advertising measurement, and sharing with data brokers. Review each SDK.
Request authorization before tracking
Use AppTrackingTransparency for authorization and include NSUserTrackingUsageDescription to explain the request. Check the returned authorization status before enabling tracking behavior.
Keep App Store privacy details aligned
Your App Store privacy answers include data collected by third-party partners whose code you integrate. Review tracking, data linked to users and the published privacy policy together.
Common mistakes to check
Treating website consent as ATT permission
A website consent choice does not override a denied ATT decision in the app. Honor the platform authorization result.
Replacing a denied identifier with fingerprinting
Apple prohibits deriving device information to uniquely identify a device or user. A different identifier is not a workaround for denied tracking permission.
Your review checklist
Our suggested review process. The linked requirements above explain the platform or legal basis.
Map native and web data flows
Scan the public app website, then inspect native SDK configuration, network traffic and partner contracts. Separate first-party analytics, advertising and cross-company sharing by purpose.
Review all permission states
Test fresh installation, refusal, approval and a later settings change. Confirm when tracking SDKs start and what happens to collected data in each state.
Publish a consistent set of disclosures
Review the draft policy, ATT purpose string and App Store privacy answers side by side. Keep a release checklist for SDK additions and changes in data recipients.
Example
An app adding advertising attribution
A fictional fitness app adds an attribution SDK. The team checks whether its configuration links user data across companies, rather than deciding from the SDK’s name alone.
Review before the release
Where the chosen activity requires ATT, the team gates it on authorization, tests refusal and updates the policy and App Store answers before submitting the release.
Questions before publishing
Does every analytics tool require ATT?
It depends on actual data use and Apple’s tracking definition.
Does the ATT prompt replace privacy details?
No. App Store privacy details describe collection and uses, including relevant third-party practices; they remain a separate disclosure.
Where does the app read the decision?
The AppTrackingTransparency API exposes trackingAuthorizationStatus and the authorization request result. Use those states in the app’s behavior.
Source review and changes
First edition: platform requirements, implementation checks and fictional worked example. Sources reviewed on the date above; verify changes before relying on them.