An ITMS-91061: Missing privacy manifest rejection email looks as follows: ITMS-91061: Missing privacy manifest- Your app includes "<path/to/SDK>", which includes , an SDK that was identified in the documentation as a privacy-impacting third-party SDK. Starting February 12, 2025, if a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a privacy manifest file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a privacy manifest. For more details about this policy, including a list of SDKs that are required to include signatures and manifests, visit: https://developer.apple.com/support/third-party-SDK-requirements. Glossary ITMS-91061: Missing privacy manifest: An email that includes the name and path of privacy-impacting SDK(s) with no privacy manifest files in your app bundle. For more information, see https://developer.apple.com/support/third-party-SDK-requirements. : The specified privacy-impacting SDK that doesn't include a privacy manifest file. If you are the developer of the rejected app, gather the name of the SDK from the email you received from Apple, then contact the SDK's provider for an updated version that includes a valid privacy manifest. After receiving an updated version of the SDK, verify the SDK includes a valid privacy manifest file at the expected location. For more information, see Adding a privacy manifest to your app or third-party SDK. If your app includes a privacy manifest file, make sure the file only describes the privacy practices of your app. Do not add the privacy practices of the SDK to your app's privacy manifest. If the email lists multiple SDKs, repeat the above process for all of them. If you are the developer of an SDK listed in the email, publish an updated version of your SDK that includes a privacy manifest file with valid keys and values. Every privacy-impacting SDK must contain a privacy manifest file that only describes its privacy practices. To learn how to add a valid privacy manifest to your SDK, see the Additional resources section below. Additional resources Privacy manifest files Describing data use in privacy manifests Describing use of required reason API Adding a privacy manifest to your app or third-party SDK TN3182: Adding privacy tracking keys to your privacy manifest TN3183: Adding required reason API entries to your privacy manifest TN3184: Adding data collection details to your privacy manifest TN3181: Debugging an invalid privacy manifest

General: Forums topic: Privacy & Security Forums tag: Privacy Developer > Security — This also covers privacy topics. App privacy details on the App Store UIKit > Protecting the User’s Privacy documentation Bundle Resources > Privacy manifest files documentation TN3181 Debugging an invalid privacy manifest technote TN3182 Adding privacy tracking keys to your privacy manifest technote TN3183 Adding required reason API entries to your privacy manifest technote TN3184 Adding data collection details to your privacy manifest technote TN3179 Understanding local network privacy technote Handling ITMS-91061: Missing privacy manifest forums post Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

I have a Java Swing application that is bundled into an app bundle using jpackage. The app basically launches a newer version of itself, when there is a new version downloaded in the users installation directory. I have noticed a regression or change in behavior with how LocalNetwork privacy works now. Previously, we would launch our Java application using the .app bundle. This is a launcher that checks for updates and will launch another JVM instance using any new jars it downloads when updating. So, it is closing the original process and spawning a new process using the downloaded jar. The new process is where the app connects to a server on the Local Network. This new process cannot access the Local Network even when the entry in privacy and security is enabled for the parent process. I have changed the behavior of my launcher application so that it keeps the process alive after launching the client application. When doing this, Local Network access works. So, my question is: is it required for the parent process to be running in order for a child process to have Local Network access? In previous macOS versions, this was not an issue, so something has changed with Local Network security across all the latest versions 26 and 27.

Hello, My colleague and I are building a digital wellbeing app for high school students aged 14–17. Students install it on their own iPhones and choose to use it. It is not a covert monitoring or parental control tool. Students set a daily social media goal and earn points for meeting it, which they can redeem for rewards offered by their school. We plan to use FamilyControls with individual authorization, and DeviceActivity. We have read the Family Controls Framework section of the Developer Program License Agreement (section 3.3.3). It says device or usage data may not be shared beyond the individual and their device, and we want to design within it. On-device storage: A DTS reply in another thread (https://developer.apple.com/forums/thread/825822) says device activity data may be used within the device activity target, as long as this doesn't involve storing or manipulating the data. May our DeviceActivityMonitor extension record in an App Group that a threshold was reached, so our main app can show the student their own progress? Derived results: With the student's explicit consent, may the app send our server only a coarse result computed on the device? For example: a. "Goal met" or "goal not met" for the day b. A daily tier, such as "under 1 hour" Does Apple consider either of these "device or usage data"? Redeeming rewards: If neither is allowed, what is the recommended way to let a student redeem a reward based on a result that stays on their device? School distribution: Schools would distribute the app. Staff would see only class-level aggregates, computed on our server from the results in question 2, such as "70% of consenting students met their goal". No individual result is visible to anyone but the student. Would this count as an "organizational setting" under the agreement? If so, which part of the design causes that? Would love some help on these questions, Barak

Hello, We are investigating the new annual ATT reprompting behavior introduced in iOS 27.2 for EU users. Apple's documentation states that developers can request ATT authorization again one year after the user's previous choice. However, we would like to clarify how this applies to existing ATT decisions made before iOS 27.2. Questions Previous ATT decisions older than 12 months If a user denied ATT permission in March 2025 on an earlier iOS version and upgrades to iOS 27.2 in November 2026, can the app immediately display the ATT prompt again? Previous ATT decisions less than 12 months old If a user denied ATT permission in June 2026, will the next ATT prompt become available in June 2027, or does the 12-month period start from the installation of iOS 27.2? Historical ATT decision timestamps Does iOS maintain the original timestamp of ATT decisions made on previous iOS versions, or does the new annual reprompting mechanism only track decisions recorded from iOS 27.2 onwards? Reprompt eligibility API Is there any public API that allows developers to determine whether a user is eligible for an ATT reprompt, without actually attempting to display it? Context This is particularly important for existing applications and Consent Management Platforms (CMPs), where we need to coordinate ATT authorization with GDPR consent flows. Understanding whether the 12-month interval applies retroactively to existing ATT decisions would help us implement the new behavior correctly without unnecessarily prompting users or disrupting existing consent flows. Thank you for your clarification

An optional coaching feature in my planned app would, after explicit opt-in, send a short text summary (for example sleep duration or heart rate variability over the last week) to a third-party AI service to generate advice for that same user. The data is not used for advertising, marketing or data mining. Guideline 5.1.3(i) allows disclosure of HealthKit-derived data only "for improving health management, or for the purpose of health research, and then only with permission", and DPLA 3.3.3(H) allows disclosure to a third party only with prior express consent and only to provide health, motion or fitness services. Is a per-user coaching feature like this within what 5.1.3(i) and 3.3.3(H) permit? Does it matter whether the summarised values were entered manually (and stored in HealthKit) or measured by a device? I understand this is not a pre-approval; I would like to know how the rule is meant to be read. Thank you.

I am planning an iOS app for strength training, nutrition and sleep. Before I build the data layer I would like to understand how Apple reads the following rules. Planned design: Body measurements and sleep values live in HealthKit only and are never written to iCloud or CloudKit. Training sessions and meal entries (food, calories, macronutrients, entered manually or by barcode scan) are stored on the device and in the user's private CloudKit database. Nothing is stored on our own servers. The app also caches packaged food products the user has scanned (name, ingredients, allergens, nutrition facts from the public Open Food Facts database) in the same private CloudKit database. Guideline 5.1.3(ii) says apps "may not store personal health information in iCloud", and DPLA 3.3.3(D) restricts using iCloud or CloudKit for "sensitive, individually-identifiable health information" unless Apple permits it in writing. Questions: Does a meal log or a product cache in the user's private CloudKit database count as "personal health information" in this sense, as long as no HealthKit values are stored there? Is the answer different if the private CloudKit data is end-to-end encrypted (encryptedValues)? I understand that App Review cannot pre-approve an app. I am only asking how the rule is meant to be read. Thank you.

Hi all. I'm a solo developer of an iOS fitness app and I just got rejected under Guideline 5.1.2(i). I'd really appreciate some guidance, because I think I understand the rejection but I'm not sure of the right way to handle it. Here's what App Review said: "The app does not use App Tracking Transparency to request the user's permission before collecting data used to track them. Instead, the app displays a custom prompt that requests the user to allow tracking." The prompt they're talking about is a sheet I show that asks "Share usage data?" and lets the person say yes or no. Nothing is sent to our analytics provider unless they say yes. The reason I'm confused is that I don't think my app tracks anyone by Apple's definition (and a few other posts I saw online say that PostHog doesn't fall under this category). The way I read it, tracking means linking data from my app with other companies' data for targeted advertising or ad measurement, or sharing it with data brokers. My app: - Has no ads and no ad SDKs - Doesn't use the advertising identifier (IDFA) - Doesn't combine user data with other companies' data - Doesn't share data with data brokers - Declares no tracking in its privacy manifest and App Privacy label The prompt is only for product analytics through PostHog, so I can see things like which screens and features get used. Those events are tied to a random account ID. They don't include workout totals, health readings or cycle data. I asked for permission because I thought it was the right thing to do for a health and fitness app, and because Guideline 5.1.2(i) says to get permission before sharing data with third parties. It seems like the prompt may have been read as asking to track, when it's really asking for permission for analytics that aren't tracking. My plan for the resubmission is to remove the prompt, explain that in my notes, and leave a switch in Settings that's off by default. The downside is that almost nobody will ever turn it on, so I'd have very little data on how people use the app. My questions: 1. Is a custom prompt allowed when it asks permission for first-party product analytics and not tracking? Has anyone gotten one approved, and did specific wording or a note to App Review help? 2. If the app really doesn't track, is removing the prompt and explaining that in the review notes the right way to resolve this? 3. Would it be wrong to use the App Tracking Transparency prompt here? My understanding is that it's only for apps that actually track, and using it would wrongly suggest that mine does. 4. Is an off-by-default switch in Settings enough permission for analytics like this? Or is there a better way to ask that App Review is comfortable with? If anyone has been through this, or anyone from Apple can point me in the right direction, I'd really appreciate it. I want to do this the right way. Thanks!

On macOS 27 the File Provider extension of our app (Secure ShellFish, an SSH client) can't connect to any host on the local network, while the containing app connects to the same host on the same Mac without problems. Local Network is enabled for the app in System Settings, but every connection from the extension fails with "Local network prohibited". It did not happen on macOS 26 and still happens on macOS 27.2 (26B123). This is hitting end users of Secure ShellFish, not just my test setup, and it has been my number one support issue since macOS 27 was released. I filed this as FB24999927 with a sysdiagnose. I'm posting here to find out whether others with File Provider (or other) extensions see the same, and whether there is anything on our side that should make it work. Steps Install the app on a clean macOS 27 system and launch it. Choose Allow at the Local Network prompt. Add an SSH server on the local network (another Mac in my test) and open a terminal to it. This works. Open the same server in Finder (the File Provider domain under ~/Library/CloudStorage). The directory listing fails. What happens TN3179 says "In general, app extensions share the Local Network privilege state of their container app", so I expected the listing to load. Instead every connection from the extension to the LAN host is blocked, and the error depends on the networking API: CFStream: ENETDOWN (50) "Network is down" BSD socket connect(): EHOSTUNREACH (65) "No route to host" Network.framework (NWConnection, multipath TCP): waits with path unsatisfied (Local network prohibited) until our connect timeout, ETIMEDOUT (60) No Local Network prompt appears. Toggling the permission, rebooting, killing the extension process and reinstalling the app don't help. What I ruled out A stale extension process: freshly launched extension processes are blocked on their very first connection. A missing UUID cache: after installing a new build, nehelper populates the cache for the app with 14 UUIDs, including both slices of the extension's executable. The extension was blocked 23 seconds later. Shared executable UUIDs: the app and the extension have distinct Mach-O UUIDs. The sandbox: the extension has com.apple.security.network.client. A missing usage string: adding NSLocalNetworkUsageDescription to the extension's Info.plist changed nothing, with no prompt and no separate entry in System Settings. Networking in general: the extension reaches internet hosts and the Mac itself by its local name. Only other hosts on the local network are blocked. Log The blocked notification arrives with bundle_id: (null). UserEventAgent then maps the extension to the app by its UUID, nehelper answers that local network is allowed by preference, and the handler is called with the newly allowed state. Later connections from the same process are still blocked, so that state never takes effect for the extension. 09:19:37.575 UserEventAgent Got local network blocked notification: pid: 4297, uuid: 183484C2-8052-36AD-A81E-B02F15F875B3, bundle_id: (null) 09:19:37.575 UserEventAgent LocalNetwork: found bundle id com.appliedphasor.secure-shellfish.mac-provider by PID 09:19:37.575 ShellFish-Finder [C1.1.1 IPv6#dace0833.22 failed path (unsatisfied (Local network prohibited), interface: en0[802.11], ipv4, ipv6, uses wifi)] 09:19:37.576 UserEventAgent LocalNetwork: found bundle id com.appliedphasor.secure-shellfish by UUID 183484C2-8052-36AD-A81E-B02F15F875B3 09:19:37.597 nehelper UUID cache hit for com.appliedphasor.secure-shellfish 09:19:37.597 nehelper Local network allowed by preference for ShellFish (com.appliedphasor.secure-shellfish) 09:19:37.597 UserEventAgent App got response: 1 09:19:37.597 UserEventAgent Calling handler with newly allowed state: 1 09:19:44.795 fileproviderd populate-directory error: FP -1004 "Unable to list p5.local: Unable To Connect To P5.Local: Network Is Down."Questions Is this a known change in macOS 27? FB24035385 (helper and child processes no longer inherit Local Network access on macOS 27) sounds related, and other File Provider apps report the same, for example nextcloud/desktop#10885: https://github.com/nextcloud/desktop/issues/10885 Does an extension need anything on macOS 27 to share its container's Local Network privilege, such as an entitlement, an Info.plist key, or something the app must do first? If not, is there a supported workaround? The only one we see is to relay the extension's traffic through the main app over loopback, which only works while the app is running. For these users Finder integration is completely broken, because servers on the local network (Raspberry Pi, NAS, home servers) are the most common setup among them. Any pointers are much appreciated.

Our iOS app uses shm_open to create an app-owned, App Group-scoped POSIX shared-memory object. Before allowing access to previously authorized offline data, we call fstat on its file descriptor to verify the object's size, owner UID, and permission mode. We do not access file timestamps, use this information for fingerprinting, or send the metadata off-device. Apple's approved reason C617.1 refers to files inside app or App Group containers. However, POSIX shared-memory objects have no filesystem entry. Does C617.1 cover this specific use of fstat? If not, should we request a new approved reason?

Hi, Apple recently announced that Apple Intelligence will launch in mainland China with iOS 27.3. Will the Foundation Models framework also become available to third-party apps in mainland China? If so, will it use the new iOS 27 Apple Foundation Model or an older version? Will the new capabilities and Private Cloud Compute also be supported? Thanks!

in this weeks i received this error: ITMS-91055: Invalid API reason declaration - The PrivacyInfo.xcprivacy for the “VanigliaPro” file contains “App Functionality” as the value for a NSPrivacyAccessedAPITypeReasons key instead of a valid reason code for using an API in the NSPrivacyAccessedAPICategoryFileTimestamp category. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, values for NSPrivacyAccessedAPITypeReasons keys in your app’s privacy manifest must be valid reason codes for the corresponding API category. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api. ITMS-91053: Missing API declaration - Your app’s code in the “xxxx” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryUserDefaults. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api. ITMS-91053: Missing API declaration - Your app’s code in the “xxxx” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryFileTimestamp. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api. any help for make correct privacy file?

I'm developing an Accessibility-enabled app that includes a helper app registered as a launch daemon using SMAppService. This daemon will connect to HID which requires both being root as well as having Accessibility (or Input Monitoring) permissions. I want this app to have as little friction for the user as I can manage. One friction I'd like to avoid is requiring the user to grant more than one application permission to use Accessibility features. So I'm wondering if I can set up the launch daemon so that it inherits the TCC permissions of its parent bundle. I'll note that the one way I've found that works is to not have the helper app have its own app bundle, but rather just have it be an executable placed alongside the main executable in enclosing bundle's Contents/MacOS directory. This has the disadvantage though of having the helper process and main process have the same name in Activity Monitor, which I think will be confusing to users. So in short, is there a supported way for a bundled application with its own CFBundleName / CFBundleDisplayName key to run as a launch daemon and also inherit Accessibility permissions from its parent app bundle?

Hi everyone! We recently integrated "Sign in with Apple" into our application using standard social login flows. For the vast majority of our users, the integration works perfectly—we receive the user's email during sign-in and sign-up. However, we are noticing an edge case where a small subset of users are returning an ID token that is completely missing the email. We can't seem to reproduce this error ourselves during testing. Every time we test a sign-up or sign-in, the email payload is included exactly as expected. My Questions: Is there a specific reason why Apple would omit the email claim from the ID token? Any insights or guidance would be greatly appreciated. Thank you!

I'm developing SipBudget, an iPhone app that will store manually entered alcohol-consumption records locally using SwiftData. The app will not use CloudKit synchronization, HealthKit, or a developer-operated cloud database. I understand that App Review Guideline 5.1.3(ii) prohibits storing personal health information in iCloud. I would appreciate technical guidance on two questions: Can a local SwiftData database be reliably excluded from ordinary iCloud device backups? If so, what is Apple's recommended implementation for ensuring that the database and related files remain excluded, including after database updates or migrations? I'm asking before implementation so I can design the storage architecture correctly. Thank you.

Hi, I'm developing an iOS app that uses a third-party library compiled with GraalVM Native Image and packaged as a dynamic framework. During a privacy compliance review, I found several Required Reason APIs in the compiled library. Their actual uses do not appear to fit Apple's documented approved reasons. 1. File Timestamp APIs (stat, fstat, lstat) The runtime uses these APIs to inspect system timezone files such as /etc/localtime, primarily checking file types, symbolic links, and sizes. However, reason C617.1 appears to cover files within the app's own containers, not system files. 2. Disk Space API (fstatvfs) The runtime uses fstatvfs to obtain filesystem block alignment information (f_frsize) for Direct I/O, rather than checking available disk space. This does not appear to match reason E174.1. 3. System Boot Time API (mach_absolute_time) The runtime uses this API to implement a monotonic clock, potentially including random seed initialization. Reason 35F9.1 covers elapsed-time measurements and timers, but does not clearly address random seeding. Questions Do these uses require Required Reason API declarations? If so, which approved reasons apply? How should developers handle API references included in a compiled runtime that may never execute in the app? If no approved reason matches these uses, what is the recommended compliant approach? The app does not use these APIs for tracking or device fingerprinting. I want to ensure the framework's Privacy Manifest accurately reflects its actual behavior rather than declaring unsupported reasons. Any guidance would be greatly appreciated. Thank you!

Hello, After a recent iOS update, I was going through my settings to set restrictions on apps installed on my device, and I noticed this option on each app's page: Learn from this App: "Allow Siri to learn from how you use [App Name] to make suggestions across apps." I turned it off right away, but it left me with several questions. In 2026, Siri has received major updates, including new AI features, and it now communicates with me much more often. Before I decide whether to turn this setting back on, I'd like to understand: What data does Siri collect from each app? For example, does it look at which apps I open and when, what I do inside them, or the content I view? How is that data used to improve suggestions? What does Siri actually do with what it learns? Where is this data processed and stored? Does it stay on my device, or is it sent to Apple's servers or synced through iCloud? How is my personal information protected? Is it linked to my Apple Account, and is it shared with app developers or third parties? How is the content I watch or read used across apps? Could something I view in one app affect suggestions in another app? Can I see or delete what Siri has already learned? If so, how? I know Apple takes privacy and security seriously, so I'm not too worried. But this is one of those features Apple didn't really talk about on stage, so I'd appreciate a clearer explanation of how it works. Thanks!

Background: We are loading a web login page inside ASWebAuthenticationSession. For login page, username and password have autofill password options enabled. On click of the username textfield when we tap the system "Passwords" suggestion in the QuickType bar above the keyboard causes the app to become completely unresponsive. No crash occurs and nothing is logged to the console. The only option to get back to the app is we must force-quit to recover. This issue is observed only on OS 26.6.1 and 26.7.1 other variant of the OS-26.x seems to be working fine. We have tested the gmail app having the ASWebAuthenticationSession for login scenario, the similar issue is observed in that too. Does anyone else also have faced similar issue ? Any help/pointers much appreciated.

iOS 27 adds a second stage to HealthKit read authorization. After picking data types, the user chooses "Past 30 Days and Future Data" or "All Recorded Data and Future Data", with Allow disabled until one is selected. Every user of every health app now makes this call, in the first seconds of onboarding, with no real context about what the app needs. I don't think the scale of this has landed yet. A meaningful share of users will pick 30 days. multi-year health trends, month to month comparisons, all-time records: with 30 days these features don't get worse, they stop existing. And it breaks silently. The user sees empty charts and a app that doesn't do what the screenshots promised. They won't connect that to a sheet they tapped through on day one — they'll connect it to the app. That's the reckoning: a wave of one-star reviews and support mail for a decision the developer never saw and can't inspect. Because we can't inspect it .authorizationStatus(for:) deliberately hides read authorization and getRequestStatusForAuthorization only says whether prompting would show UI, so a 30-day grant and a genuinely new Apple Watch user look identical from the query layer. A callback when Health permissions change for a type — even without disclosing the new state — would go a long way here. And we can't route users to the fix. UIApplication.openSettingsURLString opens the app's own Settings page, which has no Health section. The real control sits at Settings › Privacy & Security › Health › — four levels deep, unreachable from any public API. My suggestion is a URL constant scoped to the calling app, the way openNotificationSettingsURLString (iOS 15.4+) and openDefaultApplicationsSettingsURLString (iOS 18.3+) already work. But that's just my idea; if there's a better mitigation, or something already planned, I'd like to hear it. Worth saying the privacy gain looks thin either way: the app keeps all future data indefinitely, so a 30-day grant becomes a full-history grant in thirty days for anyone who keeps the app. The window limits what's readable today, not what accumulates. iOS 27 release is approaching... I think this will cause problems 😞 Filed as FB24398048 and FB24398031

On Xcode 27.0 (27A266a) / macOS 27.2, I ran xcrun mcpbridge from a scripted stdio MCP client and captured traffic system-wide, with a curl control visible in the same captures. Findings: mcpbridge itself opened no network sockets (online or offline, and under a deny-network sandbox). The "Xcode Service" process it connects to made about 2 KB of outbound TLS to an Apple edge address at startup, plus a certificate check via trustd and a request to devimages-cdn.apple.com. When a workspace was opened through XcodeOpenWorkspace, Xcode Service also made two TLS connections to appstoreconnect.apple.com (about 5 KB upstream). This did not occur without a workspace open, and XcodeListWorkspaces itself caused no traffic. mcpbridge sends a CoreAnalytics event to analyticsd (strings: "MCPBridgeTelemetry: Submitted CoreAnalytics event" / "Telemetry off; skipped"), payload <private>. Questions: What is sent to App Store Connect when a workspace is opened this way, and is it the same as opening the project in Xcode directly? What does the MCPBridgeTelemetry event contain, is it sent off-device, and what setting controls it? Is any MCP tool input or output (file contents, paths, build output) sent to Apple?

An app using FamilyControls (.individual) computes a single daily number on device from the user's own DeviceActivity data. Can that number be sent to a server so the user can compare it with friends? No app tokens, bundle IDs, or per-app times would leave the device. Is this allowed under DPLA section 3.3.3(P), which limits sharing usage data "beyond … the individual and their device"?

We run a Wi-Fi network with our own captive portal and want iOS clients to be told that Private Relay is not available here, as described in Prepare your network or web server for iCloud Private Relay and WWDC21 session 10096. Our setup: Resolver: Unbound, handed out via DHCP, with local-zone: "mask.icloud.com" always_nxdomain and local-zone: "mask-h2.icloud.com" always_nxdomain. The network is IPv4-only. The captive portal intercepts all UDP port 53 traffic and drops everything else (e.g. port 853). TCP port 53 is not served. We also tried NXDOMAIN for mask-api.icloud.com, apple-native-relay.apple.com, mask.apple-dns.net, mask-api.fe.apple-dns.net and mask-t.apple-dns.net, with no change. [Result of our resolver log: do queries for the mask hosts arrive from the test iPhone, and what do we answer? Before and after captive-portal login?] What the documentation promises: “users will be alerted that they need to either disable Private Relay for that network, or choose another network.” What happens: On [iPhone model], iOS [exact version/build], with Private Relay enabled in iCloud settings and “Limit IP Address Tracking” [on/off] for this Wi-Fi, joining our network shows no message at all. [What the user sees instead: Safari loads normally / pages fail / nothing changes.] Counter-observation: On a hotel guest network (Marriott) the same kind of device did show a notice, so the feature seems to still work on current iOS. We do not know how that network blocks Private Relay. Related reports: thread 687684 and thread 722315 describe a similar gap (network-level NXDOMAIN gives no alert, on-device DNS filtering does). Our own report: FB[number], no response so far. Questions: Which conditions must be met for iOS to show the message? Is NXDOMAIN for the two documented names enough, or does the alert also depend on other hostnames, the DNS response type (NXDOMAIN vs. NODATA), or the state of the network (e.g. before/after captive login)? Is the alert suppressed when “Limit IP Address Tracking” was turned off for that Wi-Fi earlier, or when Private Relay has already connected successfully on another network? Is the documentation still accurate for current iOS releases? If not, could it be updated?