Hello, We are investigating the new annual ATT reprompting behavior introduced in iOS 27.2 for EU users. Apple's documentation states that developers can request ATT authorization again one year after the user's previous choice. However, we would like to clarify how this applies to existing ATT decisions made before iOS 27.2. Questions Previous ATT decisions older than 12 months If a user denied ATT permission in March 2025 on an earlier iOS version and upgrades to iOS 27.2 in November 2026, can the app immediately display the ATT prompt again? Previous ATT decisions less than 12 months old If a user denied ATT permission in June 2026, will the next ATT prompt become available in June 2027, or does the 12-month period start from the installation of iOS 27.2? Historical ATT decision timestamps Does iOS maintain the original timestamp of ATT decisions made on previous iOS versions, or does the new annual reprompting mechanism only track decisions recorded from iOS 27.2 onwards? Reprompt eligibility API Is there any public API that allows developers to determine whether a user is eligible for an ATT reprompt, without actually attempting to display it? Context This is particularly important for existing applications and Consent Management Platforms (CMPs), where we need to coordinate ATT authorization with GDPR consent flows. Understanding whether the 12-month interval applies retroactively to existing ATT decisions would help us implement the new behavior correctly without unnecessarily prompting users or disrupting existing consent flows. Thank you for your clarification

Hey everyone, Curious how other iOS teams/indies are dealing with Apple's Privacy Manifests (PrivacyInfo.xcprivacy) and Required Reason APIs now that enforcement is active. Recently had to deal with third-party dependencies (both CocoaPods and SPM packages) where an undeclared API usage buried deep inside an embedded framework caused an App Store submission headache (ITMS-91053). I wanted to ask: What does your pre-submission workflow look like? Are you auditing privacy manifests and API reasons manually, using Xcode’s built-in report, or do you have a custom script in your CI/CD pipeline? Third-party SDK visibility: How do you catch when an updated dependency introduces an undeclared restricted API or tracking domain before pushing to TestFlight / App Store Connect? Local vs Cloud tooling: If you were checking compliance pre-flight, would your team ever be allowed to upload compiled .ipa binaries to a 3rd-party cloud service, or does security require everything to run 100% locally on your machine/CI runners? Is this painful enough to care? Is this just a one-time setup headache you ignore once it passes, or does dependency churn cause regular release friction? Would love to know how you guys handle this in production builds. Thanks!

Please, I have submitted an app, and the app review team requested additional information. I provided and resubmitted it again and now it is taking long. I have applied for an expedition, and it was not granted

Hi all. I'm a solo developer of an iOS fitness app and I just got rejected under Guideline 5.1.2(i). I'd really appreciate some guidance, because I think I understand the rejection but I'm not sure of the right way to handle it. Here's what App Review said: "The app does not use App Tracking Transparency to request the user's permission before collecting data used to track them. Instead, the app displays a custom prompt that requests the user to allow tracking." The prompt they're talking about is a sheet I show that asks "Share usage data?" and lets the person say yes or no. Nothing is sent to our analytics provider unless they say yes. The reason I'm confused is that I don't think my app tracks anyone by Apple's definition (and a few other posts I saw online say that PostHog doesn't fall under this category). The way I read it, tracking means linking data from my app with other companies' data for targeted advertising or ad measurement, or sharing it with data brokers. My app: - Has no ads and no ad SDKs - Doesn't use the advertising identifier (IDFA) - Doesn't combine user data with other companies' data - Doesn't share data with data brokers - Declares no tracking in its privacy manifest and App Privacy label The prompt is only for product analytics through PostHog, so I can see things like which screens and features get used. Those events are tied to a random account ID. They don't include workout totals, health readings or cycle data. I asked for permission because I thought it was the right thing to do for a health and fitness app, and because Guideline 5.1.2(i) says to get permission before sharing data with third parties. It seems like the prompt may have been read as asking to track, when it's really asking for permission for analytics that aren't tracking. My plan for the resubmission is to remove the prompt, explain that in my notes, and leave a switch in Settings that's off by default. The downside is that almost nobody will ever turn it on, so I'd have very little data on how people use the app. My questions: 1. Is a custom prompt allowed when it asks permission for first-party product analytics and not tracking? Has anyone gotten one approved, and did specific wording or a note to App Review help? 2. If the app really doesn't track, is removing the prompt and explaining that in the review notes the right way to resolve this? 3. Would it be wrong to use the App Tracking Transparency prompt here? My understanding is that it's only for apps that actually track, and using it would wrongly suggest that mine does. 4. Is an off-by-default switch in Settings enough permission for analytics like this? Or is there a better way to ask that App Review is comfortable with? If anyone has been through this, or anyone from Apple can point me in the right direction, I'd really appreciate it. I want to do this the right way. Thanks!

Since iOS 27, showing a system permission alert no longer deactivates the app. On iOS 26, sceneWillResignActive / applicationWillResignActive arrive about 0.05–0.1 s after ATTrackingManager.requestTrackingAuthorization. On iOS 27.0, 27.0.1 and 27.2 they don't arrive at all while the prompt is up, and SwiftUI's scenePhase stays .active. Apps that pause on resign, like games (Unity's iOS player pauses only on applicationWillResignActive), keep running behind the prompt: tutorials start, and timers and audio keep going. Minimal repro (plain UIKit with UIScene, fresh install so the status is .notDetermined): private var askedForTracking = false func sceneDidBecomeActive(_ scene: UIScene) { print("sceneDidBecomeActive") guard !askedForTracking else { return } askedForTracking = true DispatchQueue.main.asyncAfter(deadline: .now() + 3) { print("requesting ATT") ATTrackingManager.requestTrackingAuthorization { status in print("ATT finished: \(status.rawValue)") } } } func sceneWillResignActive(_ scene: UIScene) { print("sceneWillResignActive") }iOS 26.6: 3.27s requesting ATT 3.35s willResignActive 16.81s ATT finished: authorized 17.24s didBecomeActiveiOS 27.2: 3.21s requesting ATT 16.88s ATT finished: authorized 17.32s willResignActive 17.33s didBecomeActiveSo on iOS 27 the only lifecycle events are a resign/active pair about 0.44 s after the answer. What we found: The camera and notification permission alerts behave the same. It doesn't depend on the SDK the app is linked against, or on the thread making the request. SpringBoard's log shows the systemModalAlert deactivation assertion being added, but on iOS 27 the updateAllScenesForBand - Assertion added update never reaches the app's scene. The pending reason is only applied on the next unrelated scene update, such as a notification banner arriving, the screen dimming, an unlock, or the alert being dismissed. Taps outside the alert, a Control Center swipe or a home-indicator drag don't trigger it. Filed as FB25446786, with a sample project, delay sweeps on iOS 26 vs 27 (simulator and device) and a sysdiagnose. Is anyone else seeing this? And is there a supported way to know a permission alert is on screen until it's fixed? If you're affected, please file a Feedback and mention FB25446786; duplicates help.

I am being robbed and denigrated in Romania. Chitac Costel Danut 29/04/1977.. passport-066839639 and CNP-1770429072623 ...

Hello Apple engineers and fellow developers, We plan to distribute our iOS / iPadOS games in Germany, France, Italy, Poland, Romania, and other EU countries. We would like to clarify whether the ATT changes introduced in iOS / iPadOS 27.2 require developers to adopt the new authorization API. We currently request tracking authorization using: ATTrackingManager.requestTrackingAuthorization(completionHandler:)We access IDFA only after the user grants ATT authorization. We reviewed the following official documentation: User Privacy and Data Use — ATT in the European UnionThis page states that, beginning with iOS / iPadOS 27.2, only the alternative ATT system prompt is available for apps distributed in the five countries listed above due to legal requirements. requestTrackingAuthorization(completionHandler:) — API DocumentationThe documentation states that the system presents a full-page sheet in these five countries when this existing API is called. Based on these documents, our understanding is that the existing API automatically presents the appropriate alternative ATT prompt in these countries. Therefore, developers do not need to migrate to the new API with the preferExpandedInterface and additionalInformationAction parameters solely to request authorization and access IDFA. Could you please clarify the following? Is this understanding correct? Can games distributed in these five countries continue using the existing API and access IDFA after the user grants authorization? Is adopting the new API also optional in other EU countries? If migration is mandatory, could you point us to the official requirement, applicable OS versions, and effective date? Our question concerns Apple’s ATT API integration and migration requirements, so we can plan the necessary SDK updates. Thank you for your help!

I'm an independent developer, and at this point, I just want my app to be approved. I've spent months building GoldEngine AI, a free market-research companion providing gold market data, AI-generated forecast summaries, seasonality information and selected stock fundamentals. The Android version is already live on Google Play. But getting the iOS version through App Review has become one of the more frustrating parts of the entire development journey. A little background: 4 October: An earlier iOS submission was removed as part of the submission process. 14 October: Apple raised concerns under Guideline 3.1.1 relating to subscriptions and external purchasing. 14 October: I addressed the concerns, tested the corrected application on an iPhone using TestFlight, and submitted version 1.0.1 (Build 11). 15 October: The application is still showing "Waiting for Review." The revised iOS application removes subscription pricing, external purchase calls to action, and subscriber sign-in prompts. It now operates as a free, standalone research companion. I also provided Apple with a detailed explanation of the changes and requested consideration under Guideline 3.1.3(f), which covers certain free companion applications. I understand that Apple needs to protect customers, maintain App Store standards and ensure applications comply with its guidelines. I respect that process. But here's the frustrating part. As an independent developer, you're responsible for everything: the engineering, testing, infrastructure, security, documentation, compliance and customer communication. You spend countless hours making sure your application works, only to find yourself repeatedly refreshing App Store Connect, hoping the status changes from "Waiting for Review" to "In Review." Meanwhile, potential users are asking when the iPhone version will be available, and all I can tell them is that we're waiting for Apple. I'm not asking Apple to bypass its checks or approve an application that doesn't meet its guidelines. I'm simply hoping for a timely review, clearer communication and a little more predictability for independent developers. I'd be interested to hear from others: How long have your recent App Review submissions taken? After correcting a Guideline 3.1.1 issue, did your resubmission move through review more quickly? Have you noticed longer waiting periods during October 2026? Is there anything else worth doing beyond responding to App Review and submitting an expedited review request when appropriate? I'm keen to get GoldEngine AI into the hands of iPhone users, just as it is now available to Android users. Sometimes building the application feels easier than getting it approved. Thanks for sharing your experiences.

An app using FamilyControls (.individual) computes a single daily number on device from the user's own DeviceActivity data. Can that number be sent to a server so the user can compare it with friends? No app tokens, bundle IDs, or per-app times would leave the device. Is this allowed under DPLA section 3.3.3(P), which limits sharing usage data "beyond … the individual and their device"?

Can not update app privacy information about tracking user after remove the tracking functionality and "NSUserTrackingUsageDescription" from info.plist. Always reminds us App contains "NSUserTrackingUsageDescription"

I'm using the code below. It functions correctly on iOS 27.2 Beta 1 but crashes on iOS 27.2 Beta 2. API implemented here Xcode version - Version 27.2 beta (27B5019j) iOS Version - iOS 27.2 Beta 1 and Beta 2 behavior App Store region - Germany if (@available(iOS 27.2, *)) { [ATTrackingManager requestTrackingAuthorizationUsingExpandedInterface:YES additionalInformationAction:^{ NSLog(@"[ATT] Additional Information Clicked"); } completionHandler:^(ATTrackingManagerAuthorizationStatus status) { NSLog(@"[ATT] completion status: %ld", (long)status); }]; Resulted in a crash at runtime. No error at compile time. *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '+[ATTrackingManager requestTrackingAuthorizationUsingExpandedInterface:additionalInformationAction:completionHandler:]: unrecognized selector sent to class 0x28f3d0f80' *** First throw call stack: (0x1998ee8e0 0x19966c380 0x1999ee444 0x1998aa774 0x1998aaa30 0x1020a3a60 0x102fc8558 0x102fe1df0 0x103003dd8 0x102fd8340 0x102fd8280 0x1998a0614 0x19989187c 0x1998927e4 0x24643df24 0x19da6db54 0x1020a5264 0x1996e35b8) libc++abi: terminating due to uncaught exception of type NSException *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '+[ATTrackingManager requestTrackingAuthorizationUsingExpandedInterface:additionalInformationAction:completionHandler:]: unrecognized selector sent to class 0x28f3d0f80' *** First throw call stack: (0x1998ee8e0 0x19966c380 0x1999ee444 0x1998aa774 0x1998aaa30 0x1020a3a60 0x102fc8558 0x102fe1df0 0x103003dd8 0x102fd8340 0x102fd8280 0x1998a0614 0x19989187c 0x1998927e4 0x24643df24 0x19da6db54 0x1020a5264 0x1996e35b8) terminating due to uncaught exception of type NSException

Problem On iOS 27.0 beta (build 24A5430a) ATTrackingManager.requestTrackingAuthorization() completes with the status still .notDetermined and no prompt is ever presented. The ATT system prompt does not appear in any app on the Store. Environment iOS 27.0 beta 8 iPad and iPhone, both affected Country IT Question: Is this expected behavior, or is it a change in the new version of iOS? If it is a change, could you please point me to a reference that documents this? Happy to provide anything further through the Feedback report rather than here.

We urgently need a response from the relevant authorities

Hi, we have an app which used DeviceID to track users. We had implemented ATT and setup our privacy declaration in ASC accordingly. Now in our new version we decided to not track users anymore. We removed NSUserTrackingUsageDescription, removed ATT permission code and submitted the new version. Now, reviewer has complained that our privacy declaration in ASC still says we are tracking users and refused app acceptance. They told us to update the privacy declaration in ASC. We tried to do so, but ASC does not allow us to remove device ID tracking. It is showing a warning that our app still uses NSUserTrackingUsageDescription and in fact that is true for the production version. We are now in a chicken egg problem. We can't change our privacy declaration in ASC because the production version still uses the feature AND we do not get the new version accepted as long as our privacy declaration is not changed. How can we fix that ? Pls advise !

Currently developing a vehicle rental App in flutter for iOS/Android. Our business has an affiliate system whereby affiliates are assigned a unique QR Code for app downloads. When a new user scans QR Code, the system needs to not only direct/attribute that App Store download to the affiliate, but also any rentals the user makes should attribute a % of rental fees to the affiliate. How exactly can this be done? How can we link that user’s app/purchase activity to the affiliate? i should say these aren’t exactly ‘In-App’ purchases. Any rental transaction is routed through a stripe-like payment processor.

I work with bloggers who write reviews about my app. I would like to track sales that originate on specific sites so I can pay them commissions, like an affiliate program. For example, if a person discovers our app by reading a review, I would like to give the blogger a URL to the App Store a UTM code so that I can track if the article generates sales of my app. if there is a 3rd party affiliate program management platform or software to do this, I might be open to using it. i’ve tried searching the web and other developers about this. It should be simple but it’s elusive if it’s out there at all.

Hello, We searched Apple documentation and found no official guidance on Arcade‑specific tracking rules. Enforcement seems implicit via App Tracking Transparency (ATT) and App Review, so we want to confirm whether Arcade builds must be treated as stricter than, or the same as, normal App Store builds. Specifically: Are ATT prompts and IDFA usage completely disallowed in Arcade builds? Are third‑party analytics SDKs (e.g., Firebase, Adjust, GameAnalytics) permitted in Arcade? Is crash reporting limited to Apple‑approved frameworks only? Should all tracking/telemetry be restricted to gameplay and iCloud sync only? We plan to adjust our entitlement logic and QA requirements accordingly, so an official clarification would be very helpful. Thank you, Phong

vesion: iOS 17+ When requesting Photo Library access on iOS, the system displays a standard permission dialog. And I just wanna save a image to user's photo library. Is it possible to replace or customize this system permission popup with a fully custom-designed UI? If customization is not allowed, is the recommended approach to first present a custom explanatory popup or screen and then trigger the system permission dialog?

I am writing this as a final attempt to get some clarity regarding my app review. My app, Wecheerup 360 Booth (App ID: 676214516, Bundle ID: com.wecheerup.wecheerup360booth.ios), entered the review process on April 15, 2026. As of today, it has been in "In Review" status for nearly two months. What frustrates me is not the waiting time itself. I understand that reviews can take longer in some situations. What is becoming extremely frustrating is the complete lack of information. There are no messages in the Resolution Center. There are no requests for additional information. There are no indications that something is wrong with the app. There is simply a status that says "In Review" and nothing else. I have contacted Apple multiple times during this period. Every response I receive appears to be the same generic template stating that my app has not been forgotten and that the review is still ongoing. Whenever I ask specific questions, such as whether there is an issue with the app, whether additional information is needed, or whether there is any estimated timeline, those questions go unanswered. At this point, I feel completely stuck. I joined the Apple Developer Program specifically to publish this application. Since submitting version 1.0.3 on April 13, I have continued developing the product and have already implemented new features and newer versions. The app itself has evolved significantly while the original submission remains indefinitely in review. What I am asking for is not expedited review. I am not asking for special treatment. I am simply asking for communication. If there is an issue, please tell me. If additional review is required, please tell me. If there is a reason for the delay, please tell me. After nearly two months, receiving only generic responses and seeing no activity whatsoever in App Store Connect is incredibly discouraging. I genuinely like developing for Apple platforms, but this experience has been one of the most frustrating developer experiences I have had. Not because of the wait itself, but because there is no transparency, no feedback, and no indication that anyone is actually looking at the case. I would sincerely appreciate any clarification regarding the status of this review.

When a host app hasn't implemented ATT at all — which is still common in enterprise apps — what's the expected behavior for third-party SDKs that rely on tracking authorization? Should the SDK default to notDetermined handling indefinitely, or is there a recommended fallback experience?