PTKDMobile App Security
Knowledge base / PTKD-IOS-TRACKING-UNDISCLOSED
medium M6 MASVS-PRIVACY-3 static analysis PTKD-IOS-TRACKING-UNDISCLOSED

Tracking domains present but tracking not declared

The privacy manifest lists tracking domains but sets NSPrivacyTracking to false, an inconsistency that under-discloses tracking to users and Apple.

How it's exploited

The privacy manifest lists tracking domains but sets NSPrivacyTracking to false. That contradiction under-declares tracking to Apple and to users, and it usually means the app tracks without requesting App Tracking Transparency consent first.

Why it matters

ATT non-compliance and store-review risk, plus a privacy-policy mismatch that regulators and users can hold against you.

How to fix it

  1. Set NSPrivacyTracking to true whenever tracking domains are declared.
  2. Request ATT authorization before any tracking begins, and honor a denied choice.

References