Advertising ID reset capability provided
Why it matters
Apple's App Tracking Transparency (ATT) framework, introduced in iOS 14.5, requires explicit user authorization before an app can access the Identifier for Advertisers (IDFA) and use it for cross-app tracking. GDPR Art. 7(3) and CCPA §1798.120 extend this right to reset or limit tracking to all users in regulated regions. An app that displays ads but provides no mechanism for users to reset their advertising ID or access ad preference settings treats the user as a passive tracking target with no control. Google Play Data Safety requires disclosure of advertising ID usage; apps that collect it without providing reset capability face Data Safety accuracy flags. Apple ATT compliance is enforced at the SDK layer — ad SDKs that bypass ATT face App Store removal.
Severity rationale
Low because the failure is a missing user control rather than active data exfiltration, but Apple ATT non-compliance and GDPR Art. 7(3) right-to-withdraw violations can result in ad SDK termination and app removal.
Remediation
For iOS, request ATT authorization before initializing any ad SDK. Provide a Settings link to Apple's advertising preference panel for users who want to reset or limit tracking.
import { Platform, Linking } from 'react-native'
import { requestTrackingPermissionsAsync } from 'expo-tracking-transparency'
// iOS: Request ATT before initializing ad SDK
async function initializeAds() {
if (Platform.OS === 'ios') {
const { status } = await requestTrackingPermissionsAsync()
if (status !== 'granted') {
// Initialize ad SDK in limited-tracking mode
AdSDK.init({ limitTracking: true })
return
}
}
AdSDK.init({ limitTracking: false })
}
// Settings screen: link to platform ad preferences
function openAdSettings() {
const url = Platform.OS === 'ios'
? 'app-settings://'
: 'https://adssettings.google.com'
Linking.openURL(url)
}
Add the ATT usage description to app.json: "NSUserTrackingUsageDescription": "This allows us to show you more relevant ads".
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Mobile Permissions & Privacy Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 7(3) — Right to withdraw consent
- external · apple-att — Apple App Tracking Transparency (ATT) framework
- external · google-play-advertising-id — Google Play: Advertising ID policy
- ccpa · §1798.120 — Right to opt out of sale or sharing of personal information
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mobile-permissions-privacy·automated