Third-party SDK data collection declared in privacy manifests and store forms

Apple and Google both require that third-party SDK data collection appear in your app's privacy declarations — even data your own code never touches directly. SDKs like AppsFlyer, AdMob, and Meta Audience Network collect device identifiers, IP addresses, and app-usage signals that must be declared under GDPR Art.28 (processor relationships), GDPR Art.13 (disclosure), CCPA §1798.140(t) (sale/sharing disclosure), and COPPA §312.5 for children's data. On iOS, initialising tracking SDKs before ATT authorisation is obtained compounds the violation — the SDK reads IDFA without user consent, which is grounds for immediate rejection.

For each ad or analytics SDK, find its privacy disclosure documentation and map its data types to App Store nutrition label categories and Google Data Safety types. For iOS tracking SDKs, initialise them only after ATT authorisation:

ATTrackingManager.requestTrackingAuthorization { status in
  if status == .authorized {
    // Initialize AppsFlyer, Meta, etc.
  } else {
    // Initialize with limited data mode
  }
}

For GDPR contexts, integrate the Google UMP (User Messaging Platform) SDK before initialising AdMob. Run find ios/ -name PrivacyInfo.xcprivacy to confirm all SDK pods include their own manifests.