☂️ Support Privacy Manifest and Required APIs in iOS and macOS

[jmagman]

Umbrella issue to track the work to support privacy manifests (xcprivacy) across the engine, packages, 3p packages, tooling, etc.

From #131494:
Introduced in Xcode 15, Apple is now flagging specific APIs as needed a “Required Reason” to use. All usages of “Required Reason” APIs MUST be outlined in a Privacy manifest. A Privacy manifest is a document outlining how your app/SDK collects and uses a user’s data.

This is also time sensitive (https://developer.apple.com/news/?id=z6fu1dcu).

Starting in fall 2023, when you upload a new app or app update to App Store Connect that uses an API (including from third-party SDKs) that requires a reason, you’ll receive a notice if you haven’t provided an approved reason in your app’s privacy manifest. And starting in spring 2024, in order to upload your new app or app update to App Store Connect, you’ll be required to include an approved reason in the app’s privacy manifest which accurately reflects how your app uses the API.

https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api
https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_data_use_in_privacy_manifests
https://developer.apple.com/videos/play/wwdc2023/10060/

• Engine Flutter.xcframework Find Required Reason API usage in Flutter Engine and create Privacy Manifest #131494
• Flutter-maintained packages Find Required Reason API usage in 1P Flutter Plugins and create Privacy Manifest if applicable #131495 and [various] Add iOS privacy manifests packages#5846
• Codesign Flutter.xcframework bundle #140934
• Tooling and templates for new/existing Flutter plugins Add blank Required Reason API xcprivacy manifest to plugin template for new plugins #140013
• Policy and documentation Determine how to handle privacy manifests in packages #131940
• Native assets should be able to specify a privacy manifest #140966
• Support privacy manifests for non-plugin packages calling required reason APIs directly via FFI #147186
• Provide documentation on how to setup iOS Privacy Manifest for Flutter Modules #147140
• Add empty privacy manifest to FlutterMacOS #143381

[jmagman]

Plugin authors: follow issue #131940 for updates to our understanding of how this should work. #131940 (comment)

[navaronbracke]

I might have a clue about the deadline. In an email that I received about an iOS application, Apple indicated

ITMS-90725: SDK version issue - This app was built with the iOS 16.4 SDK. Starting April 29, 2024, all iOS and iPadOS apps must be built with the iOS 17 SDK or later, included in XCode 15 or later, in order to be uploaded to be uploaded to App Store Connect or submitted for distribution.

It also does not specify MacOS, so I think our idea of that is also correct? (although, it could also be incorrect since this was for an iOS app)

[SputNikPlop]

It also does not specify MacOS, so I think our idea of that is also correct? (although, it could also be incorrect since this was for an iOS app)

I had to specify it for a macOS and tvOS app so I believe this will come to all platforms Apple supports.

[jmagman]

I had to specify it for a macOS and tvOS app

@SputNikPlop Can you clarify? You had to specify what, and what mechanism made you specify it?

[SputNikPlop]

@SputNikPlop Can you clarify? You had to specify what, and what mechanism made you specify it?

We are accessing how much disk space is free which is a required reason api. Apple pointed us to https://developer.apple.com/documentation/bundleresources/privacy_manifest_files upon revision it is incorrect that we have to provide one for macOS in our app we provided one anyway to make it easier to use Apple's Privacy Nutrition labels should anything change in the future. I think it really came down to how we shared things cross platform, Apple really didn't tell us more but adding it passed the review. #143232 looks like the way to address it though

[jmagman]

#145269 (comment)

I would encourage anyone following this issue to read #131940 (comment), particularly the warning there.

I will be hiding any comments I encounter in the Flutter issue tracker that tell people to add arbitrary contents to a privacy manifest.