Blocks submissionApp Store

Tracking declarations agree with each other and with the tracking prompt

What is checked This rule is decided by code from the built app and the listing: ios.built.privacy_manifests, ios.built.info, ios.built.references.

Applies to every app

Checked from built, not yet uploaded, on a test track, submitted and in review, published

The rule, in our words

• Privacy manifest files: An app, and any third-party SDK that is on Apple's list or that uses a required-reason API, collects data, or contacts tracking domains, declares in a bundled PrivacyInfo.xcprivacy the data types it collects, whether it uses data for tracking (and if so the tracking domains, whose requests fail without ATT permission), and the reasons for each required-reason API it uses.
• App Review Guidelines: Personal data may not be used, transmitted or shared without the user's permission; the app must explain how and where data is used, clearly disclose any sharing with third parties (including third-party AI) and get explicit permission first; sharing with third parties is limited to improving the app or serving advertising; tracking across apps needs explicit consent through the App Tracking Transparency APIs; the app may not require users to turn on push notifications, location services or tracking to access functionality, content, the app itself or any reward; data collected for one purpose may not be repurposed without fresh consent; apps should not covertly profile users and may not de-anonymise them; no building contact databases from Contacts or Photos and no collecting installed-app lists for analytics or marketing; contacting people from Contacts or Photos only at the user's individual initiative, with no Select All and a clear preview of the message; HomeKit, HealthKit, Clinical Health Records, MovementDisorder, ClassKit and depth or facial-mapping data may not be used for marketing or data mining; Apple Pay data may only be shared to deliver or improve goods and services. Sharing data without consent can mean removal from sale and from the Developer Program.

Okkok never stores the stores' text. Each item above is our paraphrase, and the link is the page it rests on, verified unchanged by fingerprint on every run.

The other store

• Google bans sale outright and bans linking persistent device identifiers to personal data; Apple limits third-party sharing to improving the app or serving ads and separately bans building contact databases from Contacts/Photos and collecting installed-app lists. partial
• Google allows installed-app visibility for named interoperability use cases; Apple bans the collection for analytics or marketing without a listed exception. partial
• Apple requires an opt-in prompt before any cross-app tracking; Google requires respecting an opt-out setting and prohibits linking the AAID to persistent IDs, with no opt-in prompt requirement. partial
• Google adds a 2-week evidence deadline and a ban on SDK providers selling data; Apple caps permitted purposes at app improvement and advertising. same

Check your app

pip install git+https://github.com/petresandu-cloud/okkok
okkok audit path/to/app

The report names this rule as apple.privacy-manifest-tracking-consistent and says what to do, who does it, where, and how it knows.