iOS app rejected - Guideline 5.1.2 - Legal - Privacy - Data Use and Sharing. "create a unique identifier for the user's device"

user_8461815 0
Viewed 3008

"We found in our review that your app collects user and device information to create a unique identifier for the user's device. Apps that fingerprint the user's device in this way are in violation of the Apple Developer Program License Agreement and are not appropriate for the App Store. Specifically, your app uses algorithmically converted device and usage data to create unique identifier in order track the user. The device information collected by your app may include some of the following: defaultManager, NSLocaleCollationIdentifier, NSLocaleQuotationBeginDelimiterKey, NSLocaleCurrencySymbol, and NSLocaleExemplarCharacterSet."

I don't know how to resolve this issue. I store "UIDevice.current.identifierForVendor?.uuidString" and "UUID().uuidString" in UserDefaults and Keychain, then send them to server.

parts of Podfile

pod 'AppAuth', '1.2.0'
pod 'Firebase/Core', '7.5.0'
pod 'Firebase/Messaging', '7.5.0'
pod 'Firebase/RemoteConfig', '7.5.0'
pod 'Firebase/Performance', '7.5.0'
pod 'Firebase/Analytics', '7.5.0'
pod 'Firebase/Crashlytics', '7.5.0'
pod 'FBSDKCoreKit', '9.0.0'
pod 'FBSDKLoginKit', '9.0.0'
pod 'FBSDKShareKit', '9.0.0'
# Ads
pod 'Google-Mobile-Ads-SDK', '7.69.0'
pod 'FBAudienceNetwork', '6.2.1'
pod 'InMobiSDK/Core', '9.1.1'
pod 'mopub-ios-sdk', '5.15.0'
pod 'Verizon-Ads-StandardEdition', '1.8.1'
# Ads Medation
pod 'GoogleMobileAdsMediationFacebook', '6.2.1.0'
pod 'GoogleMobileAdsMediationInMobi', '9.1.1.0'
pod 'GoogleMobileAdsMediationMoPub', '5.15.0.0'
pod 'GoogleMobileAdsMediationVerizonMedia', '1.8.1.0'
pod 'AppBoxoSDK', '1.3.39'
pod 'SAMKeychain'

Update:

@dfd Thanks, bro. You saved me a lot of time. I changed the App Privacy and privacy policy on appstoreconnect, then the review passed.

cocoapods app-store xcode iphone ios
2 Answers

It's cause of Adjust SDK. You can refer to this link.

user_103278830

Just to give another hint of how to solve this issue.

Long Story Short

I found out that when I imported Branch with CocoaPods, AdSupport was being dynamically linked to the App for some reason. Switching to Swift Package Manager solved my issue.

I also updated my Privacy Settings as suggested above and I made sure I answered NO to the second section of each section (NO to tracking).

Full Disclosure

IDFA can be used as long as you ask permission to the user . This doesn't prevent a 3rd party from trying to access this identifier (the system will just return 0s). See for instance how Branch handles it, they check at runtime for AdSupport framework.

From my understanding, if they detect this framework is linked (you don't necessarily see it in your project's Frameworks, Libraries, and Embedded Content) they'll reject your App.

In my case, I found out that when I imported Branch with CocoaPods, AdSupport was being linked for some reason. Switching to Swift Package Manager solved my issue. You can check it by using this snippet:

// DO NOT IMPORT AdSupport

if NSClassFromString("ASIdentifierManager") != nil {
  print("AdSupport is linked somehow")
}

I also reviewed my Privacy Settings, but this is very particular for every App. In every section, I updated the checkboxes as best as I could and after clicking Next I made sure the second question (referring to tracking) was answered as NO.

Finally, for User ID and Device ID sections, I made sure that Third-Party Advertising and Developer’s Advertising or Marketing were unchecked.

user_38468570
Related