ATT framework requested before any tracking identifier is read

Apple's ATT framework (external apple-att-framework) requires explicit user authorisation before any app reads the IDFA or allows tracking SDKs to access cross-app identifiers. Initialising AdMob, Meta, or AppsFlyer in AppDelegate.application(_:didFinishLaunchingWithOptions:) before the ATT prompt resolves means those SDKs read IDFA before consent — a direct violation of Apple's policy, GDPR Art.7 (consent must precede processing), and CCPA §1798.120 (right to opt out of sale/sharing). Apple has rejected apps for this pattern since iOS 14.5 and continues to enforce it on every submission. Missing NSUserTrackingUsageDescription in Info.plist causes the app to crash when the ATT dialog is triggered.

Request ATT authorisation before initialising any SDK that reads device identifiers. Trigger the prompt in applicationDidBecomeActive, not didFinishLaunchingWithOptions:

import AppTrackingTransparency

func applicationDidBecomeActive(_ application: UIApplication) {
  ATTrackingManager.requestTrackingAuthorization { status in
    DispatchQueue.main.async {
      switch status {
      case .authorized:
        GADMobileAds.sharedInstance().start()
      default:
        GADMobileAds.sharedInstance().start() // limited mode
      }
    }
  }
}

For Expo/React Native, use expo-tracking-transparency and await requestTrackingPermissionsAsync() before any SDK initialisation. Add NSUserTrackingUsageDescription to Info.plist with a specific description of the tracking purpose.