{"id":50736,"date":"2023-09-06T13:10:25","date_gmt":"2023-09-06T20:10:25","guid":{"rendered":"https:\/\/www.kochava.com\/?p=50736"},"modified":"2023-12-12T17:06:23","modified_gmt":"2023-12-13T01:06:23","slug":"ios-17-privacy-manifests-what-you-need-to-know","status":"publish","type":"post","link":"https:\/\/www.kochava.com\/ko\/blog\/ios-17-privacy-manifests-what-you-need-to-know\/","title":{"rendered":"iOS 17 Privacy Manifests – What You Need to Know"},"content":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” top_padding=”20px” constrain_group_1=”yes” bottom_padding=”20px” left_padding_desktop=”20″ constrain_group_2=”yes” right_padding_desktop=”20″ text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all” css=”.vc_custom_1702429282201{background-color: #fbfbfb !important;}”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_raw_html]JTNDZGl2JTIwc3R5bGUlM0QlMjJkaXNwbGF5JTNBZmxleCUzQiUyMGFsaWduLWl0ZW1zJTNBJTIwY2VudGVyJTNCJTIyJTNFJTNDc3ZnJTIweG1sbnMlM0QlMjJodHRwJTNBJTJGJTJGd3d3LnczLm9yZyUyRjIwMDAlMkZzdmclMjIlMjBoZWlnaHQlM0QlMjIyMCUyMiUyMHdpZHRoJTNEJTIyMjAlMjIlMjB2aWV3Qm94JTNEJTIyMCUyMDAlMjA1MTIlMjA1MTIlMjIlM0UlM0MlMjEtLSUyMUZvbnQlMjBBd2Vzb21lJTIwRnJlZSUyMDYuNS4xJTIwYnklMjAlNDBmb250YXdlc29tZSUyMC0lMjBodHRwcyUzQSUyRiUyRmZvbnRhd2Vzb21lLmNvbSUyMExpY2Vuc2UlMjAtJTIwaHR0cHMlM0ElMkYlMkZmb250YXdlc29tZS5jb20lMkZsaWNlbnNlJTJGZnJlZSUyMENvcHlyaWdodCUyMDIwMjMlMjBGb250aWNvbnMlMkMlMjBJbmMuLS0lM0UlM0NwYXRoJTIwZmlsbCUzRCUyMiUyMzAwYjNlMyUyMiUyMGQlM0QlMjJNMjU2JTIwNTEyQTI1NiUyMDI1NiUyMDAlMjAxJTIwMCUyMDI1NiUyMDBhMjU2JTIwMjU2JTIwMCUyMDElMjAwJTIwMCUyMDUxMnptMC0zODRjMTMuMyUyMDAlMjAyNCUyMDEwLjclMjAyNCUyMDI0VjI2NGMwJTIwMTMuMy0xMC43JTIwMjQtMjQlMjAyNHMtMjQtMTAuNy0yNC0yNFYxNTJjMC0xMy4zJTIwMTAuNy0yNCUyMDI0LTI0ek0yMjQlMjAzNTJhMzIlMjAzMiUyMDAlMjAxJTIwMSUyMDY0JTIwMCUyMDMyJTIwMzIlMjAwJTIwMSUyMDElMjAtNjQlMjAweiUyMiUyRiUzRSUzQyUyRnN2ZyUzRSUzQ2RpdiUyMHN0eWxlJTNEJTIybWFyZ2luLWxlZnQlM0ElMjAxMHB4JTNCJTIyJTNFJTNDc3Ryb25nJTNFUmVjZW50JTIwRGV2ZWxvcG1lbnRzJTIwYXMlMjBvZiUyMERlY2VtYmVyJTIwMjAyMyUzQyUyRnN0cm9uZyUzRSUzQyUyRmRpdiUzRSUzQyUyRmRpdiUzRSUwQSUwQSUzQ3AlM0VJbiUyMGVhcmx5JTIwRGVjZW1iZXIlMkMlMjBBcHBsZSUyMHJlbGVhc2VkJTIwYSUyMCUzQ2ElMjBocmVmJTNEJTIyaHR0cHMlM0ElMkYlMkZkZXZlbG9wZXIuYXBwbGUuY29tJTJGc3VwcG9ydCUyRnRoaXJkLXBhcnR5LVNESy1yZXF1aXJlbWVudHMlMkYlMjIlMjB0YXJnZXQlM0QlMjJfYmxhbmslMjIlMjByZWwlM0QlMjJub29wZW5lciUyMiUzRWxpc3QlMjBvZiUyMDg2JTIwc29mdHdhcmUlMjBkZXZlbG9wbWVudCUyMGtpdHMlMjAlMjhTREtzJTI5JTNDJTJGYSUzRSUyMHRoYXQlMjB3aWxsJTIwcmVxdWlyZSUyMGElMjBQcml2YWN5JTIwTWFuaWZlc3QlMjBhbmQlMjBTaWduYXR1cmUlMjBzdGFydGluZyUyMGluJTIwdGhlJTIwc3ByaW5nJTIwb2YlMjAyMDI0LiUyMFRoaXMlMjBtZWFucyUyMGlPUyUyMGFwcCUyMGRldmVsb3BlcnMlMjBtdXN0JTIwaW5jbHVkZSUyMHRoZSUyMFByaXZhY3klMjBNYW5pZmVzdCUyMGFuZCUyMFNpZ25hdHVyZSUyMHdoZW4lMjBzdWJtaXR0aW5nJTIwYSUyMG5ldyUyMGFwcCUyMG9yJTIwYW4lMjBhcHAlMjB1cGRhdGUlMjB0aGF0JTIwaW5jb3Jwb3JhdGVzJTIwYW55JTIwb2YlMjB0aGVzZSUyMFNES3MuJTNDJTJGcCUzRSUwQSUwQSUzQ3AlM0VUaGUlMjBsaXN0ZWQlMjBTREtzJTIwcHJvdmlkZSUyMGElMjBtaXglMjBvZiUyMGZ1bmN0aW9uYWxpdHklMjBpbmNsdWRpbmclMjBhdXRoZW50aWNhdGlvbiUyQyUyMHB1c2glMkMlMjBVWCUyMGRldmVsb3BtZW50JTJDJTIwbmV0d29ya2luZyUyQyUyMGRhdGFiYXNlJTIwYW5kJTIwYXNzZXQlMjBtYW5hZ2VtZW50JTJDJTIwY2hhcnRzJTJDJTIwYW5kJTIwbW9yZS4lMjBJdCVFMiU4MCU5OXMlMjBub3RhYmxlJTIwdG8lMjBtZW50aW9uJTIwdGhhdCUyMEdvb2dsZSUyQyUyME1ldGElMkMlMjBGbHV0dGVyJTJDJTIwYW5kJTIwT25lU2lnbmFsJTIwYWNjb3VudCUyMGZvciUyMDU0JTIwb2YlMjB0aGUlMjA4NiUyMFNESyUyMGVudHJpZXMuJTNDJTJGcCUzRSUwQSUwQSUzQ3AlM0VXaGlsZSUyMGl0JTIwaXMlMjBsaWtlbHklMjB0aGlzJTIwbGlzdCUyMHdpbGwlMjBncm93JTIwaW4lMjB0aGUlMjBmdXR1cmUlMjB0byUyMGluY2x1ZGUlMjBhZGRpdGlvbmFsJTIwU0RLcyUyQyUyMGl0JTIwaXMlMjBub3QlMjBpbW1lZGlhdGVseSUyMGNsZWFyJTIwd2hhdCUyMGRyb3ZlJTIwdGhpcyUyMGluaXRpYWwlMjBTREslMjBsaXN0aW5nJTIwb3IlMjBob3clMjBpdCUyMG1pZ2h0JTIwYmUlMjBleHBhbmRlZC4lMjBLb2NoYXZhJTIwU0RLJTIwZW5naW5lZXJzJTIwd2lsbCUyMGNsb3NlbHklMjBtb25pdG9yJTIwYW55JTIwZnV0dXJlJTIwZGV2ZWxvcG1lbnRzLiUyMEFsbCUyMEtvY2hhdmElMjBpT1MlMjBTREtzJTIwd2lsbCUyMGJlJTIwcmVhZHklMjB0byUyMHN1cHBvcnQlMjBBcHBsZSVFMiU4MCU5OXMlMjBQcml2YWN5JTIwTWFuaWZlc3RzJTIwYW5kJTIwU2lnbmF0dXJlJTIwcmVxdWlyZW1lbnRzLiUzQyUyRnAlM0U=[\/vc_raw_html][\/vc_column_inner][\/vc_row_inner][vc_column_text css=”.vc_custom_1693930558514{padding-bottom: 20px !important;}”]\r\n

Expected impacts from Apple\u2019s new privacy-focused developer controls<\/h2>\r\n[\/vc_column_text][vc_column_text]With Privacy Manifests on iOS 17, Apple is giving iOS app developers new control over the egress of data from their apps. Recall this important excerpt from <\/span>Apple\u2019s User Privacy and Data Use Policy<\/span><\/a> FAQ:<\/span>[\/vc_column_text][vc_row_inner equal_height=”yes” content_placement=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”2\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_column_text]\r\n

Question:<\/strong><\/p>\r\n

I have integrated an SDK from another company. Am I responsible for the data collection and tracking of users of my app by that company?<\/p>\r\n

Apple\u2019s Response:<\/strong><\/p>\r\n

Yes. Developers are responsible for all code included in their apps. If you are unsure about the data collection and tracking practices of code used in your app that you didn\u2019t write, we suggest contacting the developer of the SDK.<\/p>\r\n[\/vc_column_text][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][image_with_animation image_url=”50745″ image_size=”full” animation_type=”entrance” animation=”None” animation_movement_type=”transform_y” hover_animation=”none” alignment=”” border_radius=”none” box_shadow=”none” image_loading=”default” max_width=”100%” max_width_mobile=”default”][\/vc_column_inner][\/vc_row_inner][vc_column_text]The key here is that <\/span>\u201cdevelopers are responsible for <\/b>ALL<\/b> code included in their apps.\u201d<\/b> Prior to Privacy Manifests, a developer implementing third-party SDKs had to trust that the SDK functionality was not collecting and using data for any purpose outside the scope of Apple\u2019s User Privacy and Data Use Policy. If there was any doubt, the developer had no recourse to prevent unauthorized usage other than to pull the SDK altogether\u2014not an ideal approach.\u00a0<\/span>\r\n\r\nPrivacy Manifests allow the developer to keep SDKs in their app while ensuring they can’t transmit certain data points without a user first consenting to allow app tracking via the AppTrackingTransparency (ATT) framework. This is particularly helpful for app developers integrating SDKs that they may not yet fully trust or understand.\u00a0<\/span>\r\n\r\nThat being said, when developers are working with SDKs of trusted partners like a mobile measurement partner (MMP), analytics provider, data management platform, and more—care will have to be taken to ensure the proper implementation of certain Privacy Manifest features.<\/span>[\/vc_column_text][vc_column_text css=”.vc_custom_1693930566226{padding-top: 20px !important;padding-bottom: 20px !important;}”]\r\n

Zeroing in on tracking domains<\/h3>\r\n[\/vc_column_text][vc_column_text]One particular component of Privacy Manifests, the declaration of tracking domains, requires special attention. Here\u2019s an excerpt from Apple\u2019s documentation. <\/span>[\/vc_column_text][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all” css=”.vc_custom_1693930550201{padding-top: 20px !important;padding-bottom: 20px !important;}”][vc_column_inner column_padding=”padding-2-percent” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”1px” column_border_color=”#00b3e3″ column_border_style=”solid” enable_border_animation=”true” column_padding_type=”default” gradient_type=”default”][vc_column_text]Declare tracking domains in your app\u2019s privacy manifest<\/i><\/b>\r\n\r\nIf you determine that the domains your app connects to are using data sent from your app to track people, declare them in your privacy manifest and ask for permission to track under the App Tracking Transparency framework. For more information, see <\/span><\/i>User Privacy and Data Use<\/span><\/i><\/a>. The operating system blocks network requests to declared tracking domains when the user has not granted tracking permission.<\/span><\/i>\r\n\r\nIf you are not expecting your app to track, consider removing the code or contacting the third-party SDK developer whose code is contacting the domain. If the third-party SDK has a privacy manifest, the manifest may also provide you with details about whether the third-party SDK is engaged in tracking. For more information, see <\/span><\/i>Describing data use in privacy manifests<\/span><\/i><\/a>.<\/span><\/i>[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_column_text]This means that any domain declared by a developer as engaging in tracking will have all network traffic blocked when ATT=0 (e.g., the user hasn\u2019t opted to allow tracking via the ATT framework). Apple defines \u2018tracking\u2019 as:<\/span>\r\n\r\n\u201cthe act of linking user or device data collected from your app with user or device data collected from other companies\u2019 apps, websites, or offline properties for targeted advertising or advertising measurement purposes.\u201d<\/span>\r\n\r\nHowever, there\u2019s one potential hiccup here. <\/span>What if an app developer mistakenly declares a domain that\u2019s not engaged in tracking?<\/b>\u00a0<\/span>\r\n\r\nTo be clear, Apple isn\u2019t dictating what these domains are, but rather looking to developers to make this decision themselves. This is where it becomes vital for app developers and marketers to closely communicate with their vendors. If this component is not implemented correctly by an app developer, the potential exists to handicap important functionalities provided by an MMP, for example, that are completely unrelated to tracking as defined by Apple\u2019s ATT framework.<\/span>[\/vc_column_text][vc_column_text css=”.vc_custom_1693930573722{padding-top: 20px !important;padding-bottom: 20px !important;}”]\r\n

Providing implementation guidance as a 3rd party SDK provider<\/h3>\r\n[\/vc_column_text][vc_column_text]To help app developers and marketers optimally navigate implementation, we will be creating Privacy Manifests for all of our SDKs that support iOS app measurement. In these Privacy Manifests we will clearly spell out what data is collected and for what reasons. Additionally, new developer documentation will provide clarity on which domains contacted by our SDKs are used to provide consented tracking and therefore should be declared as tracking domains.\u00a0<\/span>\r\n\r\nIn 2021, Kochava released Privacy Profiles to provide our clients with complete control over how our SDKs collect and use data when ATT consent is not present, including controls to ensure no tracking takes place. We\u2019re excited to further iterate on Privacy Profiles and will be segmenting out new domains for network communication from our SDK that allow for continued data signals unrelated to tracking, but vital for other functionality, including:\u00a0<\/span>\r\n