[apike]

Yes, but – Apple's documentation says that the upcoming opt-in requirement is for more than for IDFA-based tracking. https://developer.apple.com/app-store/user-privacy-and-data-...

According to Apple, the opt-in API is also required for other activities, including:

> Placing a third-party SDK in your app that combines user data from your app with user data from other developers’ apps to target advertising or measure advertising efficiency, even if you don’t use the SDK for these purposes. For example, using an analytics SDK that repurposes the data it collects from your app to enable targeted advertising in other developers’ apps.

So as a developer, you need to ask: even though we don't use IDFA, is this analytics SDK repurposing our data to fingerprint and target our users? Certainly for the default setups of these adtech-backed free analytics SDKs the answer is "presumably yes?". But we don't yet have a clear answer from Apple or the vendors as to what exactly will trigger an App Review rejection here, and what exactly the SDKs do with the data they receive in different circumstances.

Hence the uncertainty.

[Spivak]

The world where people are just dropping huge opaque blobs of code into their own apps that betray your users privacy, probably, we didn't actually check, is awful. How is the person releasing the app not ultimately responsible for every line of code in it?