PTKDMobile App Security
Knowledge base / PTKD-IOS-TRACKER-UNDISCLOSED
medium M6 MASVS-PRIVACY-1 static analysis PTKD-IOS-TRACKER-UNDISCLOSED

Third-party tracker not disclosed in the privacy manifest

An advertising/analytics SDK is embedded but the Apple privacy manifest does not declare tracking (NSPrivacyTracking) or any tracking domains — an under-disclosure that risks App Store rejection and ATT non-compliance.

How it's exploited

An advertising or analytics SDK is embedded, but the Apple privacy manifest neither declares tracking nor lists any tracking domains. The app therefore tracks users while telling Apple and the user that it does not.

Why it matters

App Store rejection risk and ATT non-compliance, plus the same undisclosed-tracking exposure that draws regulatory attention.

How to fix it

  1. Set NSPrivacyTracking and list the SDK's tracking domains in NSPrivacyTrackingDomains.
  2. Request ATT consent before initializing the SDK, and remove SDKs you do not need.

References