What each SDK means for your app's privacy disclosures
One page per SDK: whether it needs the tracking prompt, what it does to your App Store labels and Play Data safety form, and the rejection it is usually behind.
Your app collects what your SDKs collect
Both stores ask what the app collects, and neither accepts "I did not write that part" as an answer. The libraries you installed are your app as far as a reviewer and a regulator are concerned, which is why a developer who genuinely collects nothing still has a form to fill in.
One page per SDK below, because the answer is different for each: an ad network needs a tracking prompt, a consent gate and a California opt-out, and a crash reporter needs none of the three.
Ad network
These need App Tracking Transparency, must not run before European consent, and count as selling or sharing in California.
Attribution and install measurement
These need App Tracking Transparency, must not run before European consent, and count as selling or sharing in California.
Product analytics
These do not on their own require a tracking prompt.
Crash and performance monitoring
These do not on their own require a tracking prompt.
Subscription and payment infrastructure
These do not on their own require a tracking prompt.
Push and in-app messaging
These do not on their own require a tracking prompt.
Accounts and backend
These do not on their own require a tracking prompt.
Model API
These do not on their own require a tracking prompt.
Keeping it true after launch
A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. No store re-checks your pages against your build, so the drift is yours to notice.
- Re-read it whenever you add a dependency that sees user data.
- Re-check what loads on the page after any change: the cookie notice and the policy have to agree.
- Keep the URL stable. Changing where a policy lives breaks every listing that points at it.
Common questions
How do I find out which SDKs are actually in my app?
Read the dependency file rather than your memory of it: Package.resolved or the Podfile.lock on iOS, the resolved Gradle dependencies on Android. Transitive dependencies are the ones that surprise people, and they count the same.
My SDK is not listed here. What do I do?
Work out which of the groups above it belongs to, because the rules follow the category rather than the brand. Then read the vendor's privacy manifest for the declared list.