Apple Developers Required to Justify Use of Some APIs in Latest Move to Boost Privacy

[MacRumors]

In an effort to bolster user privacy, developers will need to justify their use of certain Apple APIs before their apps can be listed on the App Store, according to a new article on the Apple developer website spotted by 9to5Mac.

The Apple Developer website now lists some APIs as "Required Reason APIs," meaning that developers have to clarify why they are using them in their privacy manifest. Some commonly used APIs, such as UserDefaults, which stores user preferences, now fall under the Required Reason category.

With the launch of watchOS 10, iOS 17, iPadOS 17, tvOS 17, and macOS Sonoma later this year, developers will receive a warning if they submit apps using a Required Reason API without specifying its usage. From spring 2024, any apps using these APIs without a legitimate justification will be rejected in the review process.

Apple explains that main reason for this change is to curb fingerprinting, a method used to track users across different apps and websites. Fingerprinting uses API calls to gather details about a user's device, such as screen resolution, model, and operating system. This data is then used to create a unique "fingerprint," enabling the user to be identified across various apps or websites.

According to Apple, Required Reason APIs will guarantee that apps only employ these APIs for their prescribed use. In the event of a rejection, Apple will permit developers to contest the decision and submit a request for approval if their case does not fit within the existing guidelines. See the Apple Developer website for more information.


Article Link: Apple Developers Required to Justify Use of Some APIs in Latest Move to Boost Privacy

 

[zahuh]

As a developer I can't tell you how much of a pain this is going to be. As a consumer, it's not going to stop me from downloading an app but I guess good to know.

 

[Akrapovic]

I use UserDefaults for remembering the users settings. I don't even know how that API can be used to invade someones privacy. This is going to make an already poor App Approval process even worse.

 

[fatTribble]

I applaud efforts like these from Apple. Anything to enhance privacy for end users is a win in my book. 🤓🥰👏

 

[Zc456]

I can already hear Zuck yelling in frustration from within Facebook HQ.

 

[Spaceboi Scaphandre]

As a developer I can't tell you how much of a pain this is going to be.

It's gonna push more and more developers to demand alternative app stores and sideloading

 

[t0rqx]

Good for privacy reason, however how much apps will slip through QC and checks? Many stories how fraudulent apps slipped through. The Apple App Store was once the example of quality apps compared to it's Android counterpart. Now it just feels like Android Junk.

 

[antiprotest]

Good for privacy reason, however how much apps will slip through QC and checks? Many stories how fraudulent apps slipped through. The Apple App Store was once the example of quality apps compared to it's Android counterpart. Now it just feels like Android Junk.

Many apps will slip through unless your app sells or does something that Apple begins to duplicate.

 

[Macropanda]

UserDefaults... Why? What am I missing here. This is just for remembering if the user wants a specific theme or setting toggled on or not. If remembering a users settings is a privacy concern then how can an app load to the users specification?

Or am I totally missing something?

 

[Akrapovic]

UserDefaults... Why? What am I missing here. This is just for remembering if the user wants a specific theme or setting toggled on or not. If remembering a users settings is a privacy concern then how can an app load to the users specification?

Or am I totally missing something?

I agree. The implication seems to be that you could store sensitive data in there. But you could store that anywhere.

Can UserDefaults be shared across apps? If I save something in my app X, can my app Y read it? I'm aware apps outside of my developer account can't, but can my own suite of apps share it?

 

[JosephAW]

What's next? Charging for certain APIs

 

[GrantNeufeld]

UserDefaults is included because there are ways to use it to get information from the system that can be used in fingerprinting. It is not just for the app’s settings.

 

[fatTribble]

Good for privacy reason, however how much apps will slip through QC and checks? Many stories how fraudulent apps slipped through. The Apple App Store was once the example of quality apps compared to it's Android counterpart. Now it just feels like Android Junk.

Any gaps in QC can be improved over time. Because they potentially don’t catch everything doesn’t mean they should just give up.

 

[Emanuel Rodriguez]

UserDefaults... Why? What am I missing here. This is just for remembering if the user wants a specific theme or setting toggled on or not. If remembering a users settings is a privacy concern then how can an app load to the users specification?

Or am I totally missing something?

It's not used for those things exactly. More accurately, it's used to "store some data". What is that data? Well, perhaps a randomly generated ID that's used to track everything you do in an app. There would be no reason to implement such a thing for an app that requires a login though, since you're being tracked by default there, but apps that don't require one, in theory they would have a much harder time tracking you.

 

[prime17569]

I agree. The implication seems to be that you could store sensitive data in there. But you could store that anywhere.

Can UserDefaults be shared across apps? If I save something in my app X, can my app Y read it? I'm aware apps outside of my developer account can't, but can my own suite of apps share it?

You can use UserDefaults(suiteName: "<id of group container>") with App Groups to share data between apps made by the same developer. This is most commonly done to share preferences between apps and their app extensions.

In some cases, apps by the same developer share data between themselves too (e.g. for discounts based on subscription status for the developer's other apps). Apple doesn't have a reason item listed for this use case on their page, so either they forgot or they want to curb this behavior.

What's next? Charging for certain APIs

Apple already does this. See WeatherKit: https://developer.apple.com/weatherkit/get-started/

 

[fatTribble]

UserDefaults... Why? What am I missing here. This is just for remembering if the user wants a specific theme or setting toggled on or not. If remembering a users settings is a privacy concern then how can an app load to the users specification?

Or am I totally missing something?

From the article:
“Apple explains that main reason for this change is to curb fingerprinting”

 

[sw1tcher]

The Apple App Store was once the example of quality apps

iFart was an example of a quality app? 🤣

iPhone Fart App Rakes in $10,000 a Day

Get a whiff of this. Some iPhone developers are still raking in large piles of cash with their apps, and recently a fart application made nearly $10,000 in a single day. Joel Comm, developer of iFart Mobile, published download statistics of his app, and this week it stood at No. 1 overall with...

www.wired.com

https://www.fastcompany.com/90356079/whatever-happened-to-the-hottest-iphone-apps-of-2009

 

[George Bailey]

As a developer I can't tell you how much of a pain this is going to be.

As a developer I don't see this being much of a hindrance. I already justify my code by writing comments.

I can't really see someone thinking "Wait, I have to justify my code? That's outrageous!"

 

[dominiongamma]

As a developer I don't see this being much of a hindrance. I already justify my code by writing comments.

I can't really see someone thinking "Wait, I have to justify my code? That's outrageous!"

I like your attitude towards it, instead of “oh it’s going to be a pain” which gives me little faith in a developer to protect my privacy because it’s too inconvenient for them

 

[contacos]

Sounds like this could be anything, what is a proper "Reason" anyway? Who decides this? AI? some under paid person in India or Czech Republic?

 

[BadMacRumours]

This is ridiculous. UserDefaults, really?

 

[BadMacRumours]

As a developer I don't see this being much of a hindrance. I already justify my code by writing comments.

I can't really see someone thinking "Wait, I have to justify my code? That's outrageous!"

You don't think Apple requiring us justifying use of USERDEFAULTS, the most basic of APIs, is insane?

I use UserDefaults to store user preferences, settings, etc. I shouldn't need to justify that.

 

[Rogifan]

Sounds like this could be anything, what is a proper "Reason" anyway? Who decides this? AI? some under paid person in India or Czech Republic?

Phil Schiller.

 

[jonblatho]

As a developer I don't see this being much of a hindrance. I already justify my code by writing comments.

I can't really see someone thinking "Wait, I have to justify my code? That's outrageous!"

As a developer I’d assume you’re aware that Apple cannot see your code.

 

[chrono1081]

I applaud efforts like these from Apple. Anything to enhance privacy for end users is a win in my book. 🤓🥰👏

UserDefaults is kind of a weird one though. Every app uses it to store settings users set.

EDIT: Some other posters mentioned you can do nefarious things with it so I guess it makes sense.