NS*UsageDescription purpose strings present for all declared permissions
Why it matters
Missing or inadequate NS*UsageDescription strings cause automatic binary rejection — apps without them cannot be installed on TestFlight, let alone the App Store. Apple enforces this at the binary validation stage before human review begins. Beyond rejection, an empty or generic string like 'We need camera access' violates GDPR Art.5(1)(b) (purpose limitation) by failing to communicate the specific feature requiring access, and CCPA §1798.100 by withholding disclosure of why personal data is collected. Every permission your code requests must be matched with a substantive, feature-specific explanation.
Severity rationale
Critical because missing NS*UsageDescription keys cause automatic binary rejection — the app cannot be distributed on TestFlight or the App Store under any circumstance.
Remediation
For Expo managed workflow, add all permission descriptions to app.json under expo.ios.infoPlist. Each description must name the specific feature — not just the data type:
{
"expo": {
"ios": {
"infoPlist": {
"NSCameraUsageDescription": "The camera lets you attach photos to your expense reports and scan receipts.",
"NSLocationWhenInUseUsageDescription": "Your location is used to find nearby merchants and pre-fill expense addresses."
}
}
}
}
For native iOS, edit Info.plist directly in Xcode. Write descriptions in first person from the app's perspective. Audit every permission API call in the codebase and verify a matching key exists before every submission.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Privacy & Data Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · apple-requesting-permission — Requesting permission to use system features (NS*UsageDescription)
- gdpr · Art. 5(1)(b) — Purpose limitation
- gdpr · Art. 5(1)(c) — Data minimisation
- ccpa · §1798.100 — Right to know about personal information collected
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-privacy-data·automated