Apple and Google both require that third-party SDK data collection appear in your app's privacy declarations — even data your own code never touches directly. SDKs like AppsFlyer, AdMob, and Meta Audience Network collect device identifiers, IP addresses, and app-usage signals that must be declared under GDPR Art.28 (processor relationships), GDPR Art.13 (disclosure), CCPA §1798.140(t) (sale/sharing disclosure), and COPPA §312.5 for children's data. On iOS, initialising tracking SDKs before ATT authorisation is obtained compounds the violation — the SDK reads IDFA without user consent, which is grounds for immediate rejection.
High because undeclared SDK data collection creates policy violations on both platforms simultaneously and may constitute a GDPR Art.28 breach for undisclosed data processor relationships.
For each ad or analytics SDK, find its privacy disclosure documentation and map its data types to App Store nutrition label categories and Google Data Safety types. For iOS tracking SDKs, initialise them only after ATT authorisation:
ATTrackingManager.requestTrackingAuthorization { status in
if status == .authorized {
// Initialize AppsFlyer, Meta, etc.
} else {
// Initialize with limited data mode
}
}
For GDPR contexts, integrate the Google UMP (User Messaging Platform) SDK before initialising AdMob. Run find ios/ -name PrivacyInfo.xcprivacy to confirm all SDK pods include their own manifests.
app-store-privacy-data.privacy-declarations.third-party-sdk-declarationshighGADMobileAds.sharedInstance().requestConfiguration is configured; check if NSUserTrackingUsageDescription is set (required for IDFA on iOS); on Android check for the <meta-data android:name="com.google.android.gms.ads.APPLICATION_ID"> entry in AndroidManifest.xml and that Data Safety declares device IDs shared with Google. (b) Meta Audience Network — collects IDFA/AAID, app usage data. Check Settings.setAdvertiserIDCollectionEnabled(false) is NOT used without a corresponding Data Safety update. (c) Firebase Analytics — collects device identifiers, app events. Check FirebaseAnalytics.setAnalyticsCollectionEnabled(false) is not accidentally disabling analytics while the Data Safety form claims it's collected. (d) AppsFlyer/Adjust/Branch — mobile measurement partners that collect and share device IDs. Verify their SDKs are initialized with proper ATT/consent handling and their data sharing is declared. For React Native, look for AppsflyerSdk, Adjust, BranchIO imports and initialization calls. For Flutter, look in pubspec.yaml and initialization files."AppsFlyer SDK initialized in App.tsx with no ATT check — collects IDFA before user consent on iOS" or "Meta Audience Network detected in android/app/build.gradle but Data Safety form not found — Meta collects device IDs that must be declared"ATTrackingManager.requestTrackingAuthorization { status in
if status == .authorized {
// Initialize AppsFlyer, Meta, etc.
} else {
// Initialize with limited data mode
}
}