Guideline 5.1.1

Guideline 5.1.1 - Privacy: ATT Framework Without Tracking Usage Description

Low RiskEasy0 Reports

Our Take

Your app imports the App Tracking Transparency or AdSupport framework but is missing the NSUserTrackingUsageDescription in Info.plist. Apple requires this description to show the ATT prompt.

Resolution Guide

Add NSUserTrackingUsageDescription to Info.plist — This is the text shown in the ATT permission dialog. Be specific about what data is tracked and why. Example: "This identifier will be used to deliver personalized ads to you." Generic descriptions are rejected.

Implement the ATT prompt — Call `ATTrackingManager.requestTrackingAuthorization` before accessing the IDFA. Show the prompt at an appropriate time — not on first launch. Apple recommends showing it when the user encounters an ad-supported feature.

Handle all authorization states — Your code must handle `.authorized`, `.denied`, `.notDetermined`, and `.restricted`. Only access `ASIdentifierManager.shared().advertisingIdentifier` when status is `.authorized`.

Declare tracking in privacy manifest — In `PrivacyInfo.xcprivacy`, set `NSPrivacyTracking` to `true` and list tracking domains in `NSPrivacyTrackingDomains`.

If you don't actually track — If the ATT/AdSupport import is unused or leftover, remove it entirely. Remove the import statements, remove the framework from your Podfile/Package.swift, and remove `NSUserTrackingUsageDescription` from Info.plist.

Prevention:

Only add ATT when you have a concrete tracking use case

Include the purpose string at the same time you add the framework

Test the ATT flow on a physical device (simulator always returns .notDetermined)

Community Solutions · 0

More Guideline 5 (Legal) rejections

View all Guideline 5 rejections

Guideline 5.1.1 - Privacy: ATT Framework Without Tracking Usage Description

Our Take

Resolution Guide

**Add NSUserTrackingUsageDescription to Info.plist** — This is the text shown in the ATT permission dialog. Be specific about what data is tracked and why. Example: "This identifier will be used to deliver personalized ads to you." Generic descriptions are rejected.

**Implement the ATT prompt** — Call `ATTrackingManager.requestTrackingAuthorization` before accessing the IDFA. Show the prompt at an appropriate time — not on first launch. Apple recommends showing it when the user encounters an ad-supported feature.

**Handle all authorization states** — Your code must handle `.authorized`, `.denied`, `.notDetermined`, and `.restricted`. Only access `ASIdentifierManager.shared().advertisingIdentifier` when status is `.authorized`.

**Declare tracking in privacy manifest** — In `PrivacyInfo.xcprivacy`, set `NSPrivacyTracking` to `true` and list tracking domains in `NSPrivacyTrackingDomains`.

**If you don't actually track** — If the ATT/AdSupport import is unused or leftover, remove it entirely. Remove the import statements, remove the framework from your Podfile/Package.swift, and remove `NSUserTrackingUsageDescription` from Info.plist.