[FR]: Support App Privacy Manifest

[AlbGarciam]

Description

With the introduction of App Privacy manifests we're forced to declare which APIs are used, Domains where user tracking can be performed and the purpose per SDK.

https://developer.apple.com/videos/play/wwdc2023/10060/

Additionally any Firebase SDK that contains an app privacy manifest must be signed.

We would like to adopt this change as otherwise it should be added per app, and as we don't know which APIs/domains/tracking logic you're currently using we can't fulfil the privacy manifest properly

Thanks!

API Proposal

No response

Firebase Product(s)

Analytics, Remote Config

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[paulb777]

Thanks for the request. We're actively investigating the implications of the WWDC 2023 Privacy Announcements.

In the meantime, https://firebase.google.com/docs/ios/app-store-data-collection is a reference for filling out the privacy manifest.

[AlbGarciam]

Just as a help, if you decide it is necessary to include the manifest as part of your libraries, you'll also need to sign the xcframeworks

[tboogh]

This should be clear enough that it's your responsability as a SDK provider to provide a privacy manifest.

[morganchen12]

We're working on providing SDK privacy manifests for Firebase. I don't have an ETA to share, but stay tuned.

[Shwethamugeraya]

@morganchen12 Please provide privacy manifests for Firebase.

[paulb777]

We're actively working on them and expect to deliver them in an upcoming release.

[cityfarmerNexon]

We are using both firebase analytics and firebase crashlytics.
When you are delivering, will it support both static and dynamic framework?
Also, do you have any set date for the release?

[paulb777]

Since Firebase currently only ships static frameworks in its binary distributions, we plan to first support that in the first few months of the new year.

We plan to add dynamic framework support when Firebase does its next major release, sometime later in the year.

[spdysgr]

Do you have any plans for which major SDK version will support Privacy Manifest? I'm using Firebase iOS SDK 8. Due to cost considerations, it is difficult for us to immediately upgrade to the latest major version. I know you are considering this, but I would like to ask you about your current plans.

[paulb777]

@spdysgr It will likely be done in a future minor version of major version 10, but if something unexpected comes up, could require a major version 11.

[mikehardy]

Just following along, but with respect to planning @spdysgr - if you are looking to plan + allocate resources, the upstream documentation from Apple says this:

From Spring 2024, apps that don’t describe their use of required reason API in their privacy manifest file won’t be accepted by App Store Connect

In terms of planning deadlines, the most pessimistic (for us developers) interpretation of "Spring 2024" is when it starts on March 19, 2024 (about 3 months from now) and the most optimistic interpretation is June 20, 2024 (about 6 months from now) before Apple begins enforcing this.

Last time I gambled on interpretations of vague dates with Apple they started enforcing something at the earliest / most pessimistic opportunity, which was unfortunate (for me). Something to keep in mind so that you're ready for firebase-ios-sdk 10 (or maybe 11)

[spdysgr]

@paulb777 @mikehardy Thank you for your quick response. I understood that I need to upgrade to latest SDK version (currently 10, but could become 11 depending on the situation) as soon as possible. I will try planning to upgrade SDK in our team.

[LionWY]

+1

[sergiocampama]

FYI https://developer.apple.com/support/third-party-SDK-requirements/

[cityfarmerNexon]

Since Firebase currently only ships static frameworks in its binary distributions, we plan to first support that in the first few months of the new year.

We plan to add dynamic framework support when Firebase does its next major release, sometime later in the year.

@paulb777 Thank you for your reply. I've got a quick question. According to the document below
https://developer.apple.com/support/third-party-SDK-requirements/

Firebase is included in the list which Apple announced for the commonly used SDK list.
and you said that you plan to the support in the first few months of the new year.

I wonder If newly supported static framework is xcframework or framework?
If It's xcframework, SDK signature will be supported for static framework also?

The document said that SDKs in the list must support SDK Signature.
so we want to know if this new policy should be applied to static framework also.

We are waiting for new framework to fulfill Apple's new requirement.

[ncooke3]

Hi @cityfarmerNexon,

I wonder If newly supported static framework is xcframework or framework?

Static framework is equal to xcframework in the context of Paul's comment.

If It's xcframework, SDK signature will be supported for static framework also?

Yes, correct, the xcframework would be signed.

[kalsariyarahul]

Please provide privacy manifests for Firebase.

[nokiaowner]

Hello,

Is there a tentative date and target release version for privacy manifest to be included in the Firebase SDK?

Thanks

[GH-Ong]

Hello,
am bumping for an ETA for privacymanifest and code signing requirements as well

[omarzl]

You could use the generated pdf as a guide but the privacy nutrition labels on App Store Connect MUST be updated manually. I confirmed this with Apple folks.

[StartingZhou]

New release version of Firebase, still no privacy manifest, could you please help check?

[paulb777]

We weren't able to complete the privacy manifests in time for 10.21.0 and are hopeful we can release in 10.22.0, due out the week of February 26th.

[hongchanglin]

We weren't able to complete the privacy manifests in time for 10.21.0 and are hopeful we can release in 10.22.0, due out the week of February 26th.

Thank you for your continued support and the timely update regarding the privacy manifest situation.

However, as far as I know, Google Firebase provides multiple SDKs. May I confirm if all of these SDKs will include privacy manifest files in accordance with Apple's regulations?

[paulb777]

We're working on privacy manifests for all Firebase SDKs and dependencies.

[JLLA113]

We're working on privacy manifests for all Firebase SDKs and dependencies.

Hi,

In that version, Will you support the sign for sdk frameworks?

Regards!

[paulb777]

Signing will take longer and may not make the same release as the manifests, but it will follow as soon as we can. Signing is tracked at #12238.

[paulb777]

Privacy manifests for the Firebase SDKs named in https://developer.apple.com/support/third-party-SDK-requirements/ have merged to main in #12407 and is planned to be part of the next release due out the week of March 5th.

[sylvia-tencent-wmt]

Privacy manifests for the Firebase SDKs named in https://developer.apple.com/support/third-party-SDK-requirements/ have merged to main in #12407 and is planned to be part of the next release due out the week of March 5th.

Does the support for Privacy Manifests include the GoogleSignIn SDK? As of my knowledge, their development team is actively working on incorporating Privacy Manifest support. For more details, you can refer to the GitHub issue: google/GoogleSignIn-iOS#341

[clausjoergensen]

Privacy manifests for the Firebase SDKs named in https://developer.apple.com/support/third-party-SDK-requirements/ have merged to main in #12407 and is planned to be part of the next release due out the week of March 5th.

@paulb777 you'll need to update GoogleAppMeasurement as well, as it's currently pinning nanopb (one of the SDKs named on that list) to the version before the privacy manifest was introduced.

See https://github.com/google/GoogleAppMeasurement/blob/main/Package.swift#L43-L47

[ncooke3]

Hi @sylvia-tencent-wmt,

Does the support for Privacy Manifests include the GoogleSignIn SDK?

The GoogleSignIn SDK has a different release schedule, so GoogleSignIn SDK's support of privacy manifests may not exactly align with the upcoming Firebase release. I would continue to follow google/GoogleSignIn-iOS#341 for updates.

[GH-Ong]

Hi is it possible to get a date for release with privacyManifest and code signing signatures as well?

[paulb777]

See #11490 (comment) for named Firebase privacy manifests. We're working on code signing, but don't have a date yet. Follow #12238 for updates on signing.

[andrewheard]

The 10.22.0 release added privacy manifests for the Firebase SDKs named in https://developer.apple.com/support/third-party-SDK-requirements/. Signing support will continue to be tracked in #12238.

[ManoharaReddyP]

Hi @andrewheard,

I have added GoogleDataTransport.xcframework to the project and generate privacy report I am still getting error like "The archive does not contain any PrivacyInfo.xcprivacy files"
Any solution for this? Also I noticed you guys have added "GoogleDataTransport_Privacy.bundle" but when I archive it's not added in the final bundle of the app. I am using Xcode 15.

some of the frameworks are distributed as static frameworks do we need to add privacy-file in the app for those?

Any recommendations?

[GH-Ong]

Hi @andrewheard,
FirebaseCrashlytics seems to be missing from release 10.22.0's Firebase.zip

[paulb777]

@ManoharaReddyP @GH-Ong Please open separate issues with a completed template to make it easier to assess. I'm going to lock this issue for further comments. Please open a new GitHub issue for any other issues .