iOS privacy nutrition labels match actual data collection
Why it matters
Apple reviews nutrition label accuracy both during the review process and in response to user reports filed through the App Store. Mismatches like declaring analytics as 'Data Not Linked to You' while calling setUserId() expose you to enforcement and rejection on every subsequent update. Under Apple's App Privacy guidelines (external apple-app-privacy) and GDPR Art.13, users have a right to accurate disclosure of what data is collected and how it is linked to their identity. A mislabelled label is not a minor oversight — Apple has removed apps and forced resubmission for label inaccuracies.
Severity rationale
High because nutrition label mismatches trigger rejection on resubmission and expose the developer to Apple enforcement actions and potential GDPR Art.13 violations.
Remediation
Use Xcode's App Privacy Report on a real device (Settings → Privacy & Security → App Privacy Report) to see what data your app actually accesses at runtime. Cross-reference every third-party SDK's published nutrition label documentation — Google, Meta, and most major SDKs publish these.
For fastlane users, keep nutrition label declarations in fastlane/metadata/ios/ and audit them before every submission. Pay particular attention to analytics: if setUserId() or any equivalent identify() call exists in the codebase, analytics data is linked to the user and must be declared as 'Data Linked to You.'
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Privacy & Data Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · apple-app-privacy — App privacy details on the App Store
- gdpr · Art. 13 — Information to be provided where personal data are collected from the data subject
- ccpa · §1798.100 — Right to know about personal information collected
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-privacy-data·automated