In an effort to further protect user privacy, Apple has announced new policy measures for its App Store. Building on its already strong commitment to data protection, the tech giant is now requiring developers to justify their need for access to specific data in a move designed to prevent misuse of APIs (Application Programming Interfaces). APIs are tools used by developers to extract and exchange data. However, Apple has noted that some developers may utilize certain APIs to collect data about users’ devices through a process known as “fingerprinting.”
As reported by The New York Times in 2019, the ad industry had increasingly turned to this largely unseen method of user and device tracking as a response to the heightened privacy measures implemented by companies such as Apple and Mozilla. These privacy enhancements have made it more challenging for advertisers to use traditional tracking methods, like cookies or pixels in social media buttons. With the introduction of Apple's App Tracking Transparency in 2021, fingerprinting was banned, yet additional measures were needed to ensure effective regulation.
Developers will now need to select from a list of “approved reasons” explaining their use of an API, which can then be used only for the stated purposes. If developers fail to provide a reason for their use of the API, they will be notified to add an approved reason to their app’s privacy manifest before resubmission. These rules will be enforced starting from fall 2023, and by spring 2024, apps and app updates lacking an approved reason will be rejected. Apple is, however, offering developers a substantial lead time to make the necessary adjustments.
Discussion among developers on Hacker News revealed some concerns about the need to provide reasons for using UserDefaults, a commonly used API. There were, however, voices emphasizing that this is not a crackdown on legitimate use but rather a requirement to provide a stated reason.