You are. Apple's App Privacy page says developers must provide information about the practices of third-party partners whose code they integrate, and that includes SDKs. Even data collected for reasons other than analytics or advertising has to be declared. Keep the answers current as SDKs change.
What Apple's page says
Apple's text states that you provide information about your app's privacy practices, including the practices of third-party partners whose code you integrate. It defines third-party partners as analytics tools, advertising networks, third-party SDKs or other external vendors whose code you added. You must identify all data you or those partners collect, unless the data meets the criteria for optional disclosure. Apple also says you are responsible for keeping responses accurate and up to date, and for updating them if practices change.
One example on the page: placing an SDK that combines your users' data with data from other developers' apps to target advertising or measure ad efficiency counts as tracking, even if you do not use the SDK for that purpose. Apple's separate SDK page adds that privacy manifests describe the privacy practices of third-party code in a standard format, and Xcode can combine the manifests of the SDKs in your app into a single report to help you create accurate labels.
What this means in practice
The vendor's documentation is an input, not an answer. The accountable party for the label is the app owner. So:
- Privacy owns the final wording, as in our RACI.
- Engineering supplies the facts: which SDKs, which versions, which data they touch.
- The vendor supplies a data description, and you verify it against real traffic.
A four step routine
- List every SDK in the shipping build, including transitive ones. See listing every dependency in an iOS app.
- For each, collect the vendor's data description and any privacy manifest.
- Check observed behaviour against that description.
- Map data types to your declarations, and record the mapping in the register with a date.
Run it again on every SDK version change that your triage marks as affecting data.
Typical mistakes
| Mistake | Why it hurts |
|---|---|
| Treating the label as a one time task | Apple expects accuracy to be maintained |
| Trusting a vendor summary without a test | You are the one answering for it |
| Forgetting transitive SDKs | They collect data too |
| Leaving removed SDKs in the answers | The label no longer matches the app |
For the manifest side of the story, see whether third-party iOS SDKs need privacy manifests and the Android equivalent on the Play data safety form.
This post describes Apple's published guidance. It is not legal advice, and questions about legal obligations belong with your counsel.
Safeguard's SBOM and dependency scanning can list the SDKs in a build so the inventory step starts from a complete list. A free scan is at gold.safeguard.sh/scan.
Quick check
Can I rely on the SDK vendor's own privacy statement?
Use it as input. You remain responsible for your answers, so verify it against the SDK's behaviour in your app.
Do I declare data from SDKs I only use for crash reports?
Apple says data collected for reasons other than analytics or advertising still needs to be declared, unless it meets the optional disclosure criteria.
Sources
Last reviewed: 19 October 2026.
