# Privacy manifests PrivacyInfo.xcprivacy and required-reason APIs on macOS > Source-anchored research for Privacy manifests PrivacyInfo.xcprivacy and required-reason APIs on macOS. Run status: COMPLETED. Parent: [Apple Platform Frontier for Mac Utilities](https://llms-explorer.com/tree/apple-platform-frontier-for-mac-utilities/) · 2 facets · 10 facts · page: https://llms-explorer.com/tree/privacy-manifests-privacyinfo-xcprivacy-and-required-reason-apis-on-macos/ ## Problems, failure modes and limitations - Enforcement timeline for the platforms that are covered: warning emails from 2024-03-13, App Store Connect rejection of missing declarations from 2024-05-01 (ITMS-91053). Invalid manifests (unexpected keys or values) are rejected on any platform, with an email naming the bad file path. (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api) - If NSPrivacyTracking is true, domains in NSPrivacyTrackingDomains fail with an error when the user has not granted ATT permission. A DNS/network monitor that surfaces tracker domains is not itself tracking, so it should set NSPrivacyTracking false unless it really tracks. (medium confidence) — [source](https://developer.apple.com/documentation/bundleresources/privacy-manifest-files) ## Facts and statements - Apple's required-reason API documentation says to describe reasons for apps and SDKs 'on iOS, iPadOS, tvOS, visionOS, or watchOS'; macOS is not in that list. (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api) - The privacy manifest page splits scope: collected-data-type declarations are required on all platforms; required-reasons API declarations only on iOS, iPadOS, tvOS, visionOS and watchOS. (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/documentation/bundleresources/privacy-manifest-files) - Independent developers reached the same reading: SwiftLee (2024-04-30): 'As of now, an API declaration is not required for macOS'; the .NET blog (2024-03-25) says macOS and Mac Catalyst do not seem to need required-reason entries; a 2026-09-05 project issue closed with macOS excluded from required-reason platforms. (medium confidence) (verified as of 2026-09-05) — [source](https://www.avanderlee.com/xcode/missing-api-declaration-required-reason-itms-91053/) - On macOS and Mac Catalyst the app manifest goes in Contents/Resources/PrivacyInfo.xcprivacy; macOS framework manifests go in Versions/A/Resources/. iOS-family apps use the bundle root. The file name PrivacyInfo.xcprivacy is mandatory. (high confidence) — [source](https://developer.apple.com/documentation/bundleresources/adding-a-privacy-manifest-to-your-app-or-third-party-sdk) - Required-reason categories: FileTimestamp (stat, fstat, lstat, getattrlist family; codes DDA9.1 display to user, C617.1 app container, 3B52.1 user-granted files, 0A2A.1 SDK wrapper), SystemBootTime (mach_absolute_time; 35F9.1, 8FFB.1, 3D61.1), DiskSpace (statfs/statvfs family; 85F4.1, E174.1, 7D9E.1, B728.1), plus UserDefaults and ActiveKeyboard. Each has off-device-transmission limits. (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/documentation/bundleresources/app-privacy-configuration/nsprivacyaccessedapitypes/nsprivacyaccessedapitype) - Apple says it reviews the required-reason API list and reasons continually and updates the article from time to time, so macOS scope could change; declaring accurate reasons anyway is low cost for a monitor that uses stat or mach_absolute_time. (low confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api) - Apple's third-party SDK list (80+ SDKs, e.g. Firebase, Alamofire, Flutter, Realm) requires a privacy manifest plus a signature for binary dependencies, checked on App Store Connect submissions from 2025-02-12; a monitor app that bundles such SDKs must pick up versions that comply. (medium confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/support/third-party-SDK-requirements/) - Declared reasons bind behavior: data from these APIs may be used only for the declared reason, must match functionality shown to users, and may not be used for fingerprinting or tracking; most reasons forbid sending derived data off-device. (high confidence) — [source](https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api)