Search code examples
iosmanifestprivacyuserdefaults

declaring use of userdefaults in the privacy manifest: What is the wrong use of user defaults for iOS 3'rd party library?

In the documentation for the required reason API in the privacy manifest file, Apple specifies that I should indicate if my third-party SDK utilizes UserDefaults:

C56D.1 Declare this reason if your third-party SDK is providing a wrapper function around user defaults API(s) for the app to use, and you only access the user defaults APIs when the app calls your wrapper function. This reason may only be declared by third-party SDKs. This reason may not be declared if your third-party SDK was created primarily to wrap required reason API(s). Information accessed for this reason, or any derived information, may not be used for your third-party SDK’s own purposes or sent off-device by your third-party SDK.

Let me clarify: Should I declare this reason if my SDK reads and writes from the app's UserDefaults parameters (standard read and write)? What if I only read and write SDK-related data to the app's UserDefaults? Lastly, should I declare it if I read and write to the SDK's suite in UserDefaults?

Solution

  • As you stated from the documentation, it is important to understand the use case for your application here.

    Let's look at what is written in the documentation and answer the questions raised below yourself. If all answers are yes, then you need to declare this in your privacy manifest.

    1. If your third-party SDK is providing a wrapper function around user defaults API(s) for the app to use

      Is the SDK your application is using developed by you and provides an API for UserDefaults access?

    2. You only access the user defaults APIs when the app calls your wrapper function.

      Is this your use case?

    3. This reason may not be declared if your third-party SDK was created primarily to wrap required reason API(s).

      Think hard if this is your use case

    Information accessed for this reason, or any derived information, may not be used for your third-party SDK’s own purposes or sent off-device by your third-party SDK.

    Looking over your questions:

    1. Should I declare this reason if my SDK reads and writes from the app's UserDefaults parameters (standard read and write)?

      Does your SDK provide a wrapper for the application to use?

    2. What if I only read and write SDK-related data to the app's UserDefaults?

      What does your SDK do with this data? Review the above questions to see if the use case is similar

    3. Lastly, should I declare it if I read and write to the SDK's suite in UserDefaults?

      Again, what does your SDK do with this data? Review the above questions to see if the use case is similar