Apple details additional guidance on app privacy labels

App privacy labels provide users with valuable insight into how their data is handled by apps on the App Store. Developers are required to answer a series of questions relating to data collection policies, which are then displayed in App Store listings. While the feature went live in December, some developers have yet to add the labels to their app.

Apple laid out expectations in an explainer posted to its developer portal last year, noting requirements like identifying all first- and third-party app data collection policies, answering privacy questions accurately and keeping those answers up to date should data collection practices change.

In today's update, Apple makes the purpose of its privacy label feature clear.

"The purpose of the label is to help your customers understand what data is collected from your app and how it is used," Apple says. "Keep in mind that even if you collect the data for reasons other than analytics or advertising, it still needs to be declared. For example, if you collect data solely for the purpose of app functionality, declare the data on your label and indicate that it is only being used for that purpose."

A bulk of the document remains unchanged, though a section on "Additional Guidance" includes the following additions:

• Your app has web views. Data collected via web traffic must be declared, unless you are enabling the user to navigate the open web.
• You collect and store IP address from your users. Declare the relevant data types based on how you use IP address, such as precise location, coarse location, device ID, or diagnostics.
• You offer in-app private messaging between users that are not SMS text messages. Declare emails or text messages on your label. Text messages refer to both SMS and non-SMS messages.
• Your app includes game saves, multiplayer matching, or gameplay logic. Declare Gameplay Content on your label.

Developers must include privacy labels with newly submitted apps and app updates. Some larger companies, like Google, have delayed reporting, assumedly fearing blowback from users.