ATT nutrition label and actual tracking scope are consistent
Why it matters
The NSUserTrackingUsageDescription wording is a legal representation of your tracking scope that users see before deciding whether to grant ATT consent. Understating the scope — claiming 'for measurement' when the SDK also performs cross-app behavioural targeting — misleads users and violates GDPR Art.5(1)(a) (lawfulness, fairness, transparency) and CCPA §1798.100. Apple cross-checks the description against the App Store nutrition labels 'Data Used to Track You' section, and mismatches trigger rejection. Declaring SKAdNetwork-only measurement while simultaneously passing IDFA to the same ad network makes the privacy-preserving claim false.
Severity rationale
High because misrepresenting the tracking scope in the usage description is a policy violation that triggers rejection and grounds for app removal if discovered post-publication.
Remediation
Write a tracking description that covers every purpose: ad personalisation, cross-app measurement, attribution, and any analytics use involving the IDFA. Example:
"Your device identifier is used to show you ads relevant to your interests, measure ad effectiveness, and attribute app installs to ad campaigns."
Audit each ad SDK's actual data use against the description. If you want to simplify compliance, switch to SKAdNetwork-only mode — many ad networks support privacy-preserving attribution that does not require ATT consent at all. Verify SKAdNetworkItems in Info.plist and confirm the same networks are not also receiving IDFA directly, which would make the SKAdNetwork-only claim false.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Privacy & Data Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13 — Information to be provided where personal data are collected from the data subject
- gdpr · Art. 5(1)(a) — Lawfulness, fairness and transparency
- ccpa · §1798.100 — Right to know about personal information collected
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-privacy-data·automated