Skip to content
Narvy

ITMS-91061: a listed third-party SDK ships without a privacy manifest

Your IPA embeds a framework that is on Apple's list of commonly used third-party SDKs, and that framework has no PrivacyInfo.xcprivacy. Upgrade the SDK to a version that ships its own privacy manifest. Adding one to your app does not fix it.

App Store Connect e-mailITMS-91061
ITMS-91061: Missing privacy manifest - Your app includes "<path/to/SDK>", which includes <SDK>, an SDK that was identified in the documentation as a privacy-impacting third-party SDK. Starting February 12, 2025, if a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a privacy manifest file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a privacy manifest.

What it means

You must include the privacy manifest for any SDK listed below when you submit new apps in App Store Connect that include those SDKs, or when you submit an app update that adds one of the listed SDKs as part of the update.

Apple, Third-party SDK requirements

Apple's list has 87 entries, including networking, image, Firebase, Facebook and Google sign-in libraries, and many Flutter plugins (path_provider, shared_preferences_ios, url_launcher and others). Apple also requires a signature when such an SDK is a binary dependency; that part cannot be verified from an IPA, because embedded frameworks are re-signed with the app's identity.

Deadline

Apple's requirements page gives no separate date: the rule applies to new apps and to updates that add a listed SDK. The date in the e-mail above is Apple's own wording.

How to fix it

1. Find the framework

The e-mail names the path inside the app. The store check lists every embedded framework from Apple's list and whether it carries a privacy manifest.

2. Upgrade the SDK

terminal
# CocoaPods
pod update Alamofire

# Swift Package Manager: File > Packages > Update to Latest Package Versions

# Flutter
flutter pub upgrade --major-versions

Then rebuild and check that Frameworks/<Name>.framework/PrivacyInfo.xcprivacy (or a resource bundle inside it) exists in the new IPA.

Check before you submit

Upload the IPA on the store check page. It runs APPSTORE-THIRD-PARTY-SDK against the dates on this page, then deletes the file: nothing about the app is kept. The same engine runs offline in the Narvy CLI, and exits with code 1 when a blocker is found, so it can gate a CI job.

Limit: this check sees embedded frameworks only. An SDK linked statically into your executable is not detected by name.

Offline, from a terminal (narvy-cli 1.2.0 or later)
narvy store-check MyApp.ipa

Check a build in the browser

FAQ

My app has used this SDK for years. Am I concerned?

Apple's page applies the rule to new apps and to updates that add a listed SDK. An update that only keeps an SDK already shipped is not in that wording, but upgrading it removes the question.

Can I add the SDK's manifest myself?

The manifest has to be inside the SDK's bundle and describe the SDK's own data use, which only its provider knows. Upgrade instead.