In an effort to safeguard user data and privacy, Apple has taken decisive action against potential API abuse by app developers. The tech giant recently announced its plans to require developers to submit explicit reasons for utilizing specific APIs in their apps, starting later this year with the highly anticipated releases of iOS 17, iPadOS 17, macOS Sonoma, tvOS 17, and watchOS 10. This move aims to prevent APIs from being misused for data collection purposes.
Contents
Apple New Policy to Curb API Misuse
“This will help ensure that apps only use these APIs for their intended purpose,” stated Apple in an official press release. To comply with the new policy, developers will be required to carefully select one or more approved reasons that accurately depict how their apps utilize the API. Subsequently, the app can only use the API for the pre-declared reasons.
Targeted APIs under Scrutiny
The specific APIs that will now demand reasons for use are as follows:
- File timestamp APIs
- System boot time APIs
- Disk space APIs
- Active keyboard APIs
- User defaults APIs
These APIs, when misused, can lead to potential privacy breaches and may allow app developers to collect device signals for fingerprinting purposes. Fingerprinting, in turn, could be exploited to uniquely identify users across different applications and websites, enabling targeted advertising and other concerning practices.
Implementation and Enforcement
The policy enforcement will go live in Fall 2023 and will extend its reach to visionOS as well. Developers submitting new apps or app updates will need to provide explicit reasons for utilizing these “required reason APIs” in their app’s privacy manifest. Starting Spring 2024, any apps that fail to disclose their use of these APIs in the privacy manifest will face rejection.
Clear Guidelines for Developers
In its developer documentation, Apple is explicit in its stance on the matter: “Regardless of whether a user gives your app permission to track, fingerprinting is not allowed.” The company emphasizes that each app or third-party SDK must declare one or more approved reasons that accurately represent their use of the APIs and the data derived from them.
The permitted use of APIs and the data they generate is strictly limited to the declared reasons only. These reasons must align with the app’s presented functionality to users, and under no circumstances should the APIs or their derived data be used for tracking purposes.
A Positive Step Towards User Privacy
Apple’s decision to demand explicit reasons for API usage comes as a proactive measure to protect user privacy. With an ever-growing concern over data breaches and misuse, this move is likely to be welcomed by privacy advocates and users alike. By tightening its grip on app developers, Apple aims to foster an ecosystem where data is treated with the utmost care and respect.
Developers will need to be vigilant about accurately declaring their API usage, ensuring transparency with users and abiding by the company’s guidelines. As data privacy continues to be a significant issue in the tech industry, Apple’s strict approach may set a precedent for other companies to follow suit.
With these measures in place, users can have increased confidence in their digital experiences, knowing that their data is being handled responsibly. As the Fall 2023 deadline approaches, developers are encouraged to familiarize themselves with the new policy and take the necessary steps to comply with Apple’s guidelines, thus contributing to a safer and more privacy-oriented app ecosystem.
