0

To be compliant with Apple's new third party SDK requirements on user data collection and usage privacy guidelines, we updated MarketingCloudSDK version to 8.1.2. The privacy manifest file PrivacyInfo.xcprivacy is present with the value NSPrivacyAccessedAPICategoryUserDefaults.

When we run the script found here which scans the code to find usages of required reason API, it indicates the SDK uses fstat, fstatfs, stat, statfs which are quoted in Apple documentation to be required reason API.

Result of the script:

Used symbols in binary ./MarketingCloud-SFMCSdk/Frameworks/SFMCSDK.xcframework/ios-arm64_x86_64-simulator/SFMCSDK.framework/SFMCSDK: NSUserDefaults

Used symbols in binary ./MarketingCloud-SFMCSdk/Frameworks/SFMCSDK.xcframework/ios-arm64/SFMCSDK.framework/SFMCSDK: NSUserDefaults

Used symbols in binary ./MarketingCloudSDK/MarketingCloudSDK/MarketingCloudSDK.xcframework/ios-arm64_x86_64-simulator/MarketingCloudSDK.framework/MarketingCloudSDK: fstat, fstatfs, NSUserDefaults, stat, statfs

Used symbols in binary ./MarketingCloudSDK/MarketingCloudSDK/MarketingCloudSDK.xcframework/ios-arm64/MarketingCloudSDK.framework/MarketingCloudSDK: fstat, fstatfs, NSUserDefaults, stat, statfs

Extract of Apple documentation:

The following APIs for accessing file timestamps require reasons for use. Use the string NSPrivacyAccessedAPICategoryFileTimestamp as the value for the NSPrivacyAccessedAPIType key in your NSPrivacyAccessedAPITypes dictionary.

stat

fstat(::)

fstatat(::::)

So if this script is relevant, the value NSPrivacyAccessedAPICategoryFileTimestamp is missing in the privacy manifest. Is it relevant ? And if so could you add the missing value to the privacy file ? Thanks.

Improve this question

1 Answer 1

Reset to default
0

Thank you for your response. The library scans for the presence of APIs but does not indicate whether they are invoked or utilized. While the scan identifies these APIs, MarketingCloudSDK does not employ them for access. Therefore, we are currently in compliance. However, should the need arise, we will consult with our legal team and make any necessary updates.

Best regards, Prakashini

Improve this answer
2
  • Apple's review process scans binaries to identify the use of such APIs, regardless of whether these APIs are actively used or not. Given this context, you must address this and ensure full compliance with Apple's guidelines. Even if these APIs are not being actively used by the SDK, their presence will raise red flags during Apple's review process, affecting app approvals.
    – Antoine Palazzolo
    Commented Apr 10 at 12:54
  • With the deadline approaching, it is important for us to know whether Salesforce intends to update the privacy manifest to include the required keys. Please confirm if an update is planned and, if possible, provide an estimated timeline for its release. This information is important for us to plan our next steps and explore alternatives, including potentially removing the SDK.
    – Antoine Palazzolo
    Commented Apr 15 at 10:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .