Run a free ShipCheck before you resubmit. Paste a public GitHub link or upload a zip, no account needed. ShipCheck reads allowlisted project files and names each issue with the guideline, a short label, how serious it is, and how many places. It covers 16 Apple and Google Play checks, including a 5.1.2 privacy manifest check, 5.1.1 privacy, and App Tracking Transparency. A fix is $9, or 3 for $19, paid first. Run a free ShipCheck

It can't see or fill in your App Store Connect privacy answers (the privacy label), and it can't tell what your app sends to an AI service at runtime. Those parts are still on you.

Guideline 5.1.2 and privacy manifest rejections for Expo apps

"Privacy" problems from Apple usually show up as one of 3 different things. People mix them up all the time, and the fix is different for each one:

A good first step is to read your message closely and figure out which of the 3 you got. You might have more than one.

What Apple's rules say

Guideline 5.1.2

From Apple's App Store Review Guidelines, 5.1.2 Data Use and Sharing (page marked "Last Updated: October 16, 2026", fetched Nov 11, 2026):

(i) Unless otherwise permitted by law, you may not use, transmit, or share someone's personal data without first obtaining their permission. You must provide access to information about how and where the data will be used. You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so.

The same section also says:

You must receive explicit permission from users via the App Tracking Transparency APIs to track their activity.

Your app may not require users to enable system functionalities (such as push notifications, location services, tracking) in order to access functionality, content, use the app, or receive monetary or other compensation, including but not limited to gift cards and codes.

Notice what 5.1.2 doesn't mention: the privacy manifest file. The manifest rules come from Apple's developer docs, below. ShipCheck lists its privacy manifest check under the 5.1.2 label, but in Apple's own docs the guideline and the manifest rules are separate.

The privacy manifest and "required reason" APIs

Apple's Privacy manifest files page (fetched Nov 11, 2026) says the file is "named PrivacyInfo.xcprivacy" and records:

The types of data collected by your app or third-party SDK. You need to provide this information for your app or third-party SDK on all platforms.

The required reasons APIs your app or third-party SDK uses. You need to provide this information for your app or third-party SDK on iOS, iPadOS, tvOS, visionOS, and watchOS.

From Apple's Describing use of required reason API page (fetched Nov 11, 2026):

If you upload an app to App Store Connect that uses required reason API without describing the reason in its privacy manifest file, Apple sends you an email reminding you to add the reason to the app's privacy manifest. Starting May 1, 2024, apps that don't describe their use of required reason API in their privacy manifest file aren't accepted by App Store Connect.

Apple's Adding a privacy manifest to your app or third-party SDK page (fetched Nov 11, 2026) adds:

App Store Connect rejects app submissions that include invalid privacy manifest files.

Apple also keeps a list of common SDKs that must ship their own privacy manifest. From Third-party SDK requirements (fetched Nov 11, 2026):

You must include the privacy manifest for any SDK listed below when you submit new apps in App Store Connect that include those SDKs, or when you submit an app update that adds one of the listed SDKs as part of the update.

That list includes several names you'll see in React Native and Expo projects, like hermes, FirebaseCore, FirebaseAuth, FirebaseMessaging, FirebaseCrashlytics, GoogleSignIn, OneSignal, Lottie, and SDWebImage. Check the full list on Apple's page.

The App Privacy label

From Apple's App privacy details on the App Store page (fetched Nov 11, 2026):

You need to identify all of the data you or your third-party partners collect, unless the data meets all of the criteria for optional disclosure listed below.

You're responsible for keeping your responses accurate and up to date. If your practices change, update your responses in App Store Connect. You may update your answers at any time, and you do not need to submit an app update in order to change your answers.

Apple defines "third-party partners" there as "analytics tools, advertising networks, third-party SDKs, or other external vendors whose code you've added to your app."

Part 1: Fix the privacy manifest in an Expo app

Expo's Privacy manifests guide (fetched Nov 11, 2026) says the required reason APIs "currently include accessing UserDefaults, file timestamp, system boot time, disk space, and active keyboard." A library in your app can use one of these even if your own code never does.

Step 1: Update your Expo packages

Expo's guide says: "Make sure you have updated your Expo SDK libraries to the latest versions for your SDK version using npx expo install --fix." Newer versions of many libraries ship their own PrivacyInfo.xcprivacy.

Step 2: Add privacyManifests to your app config

In a managed Expo project, you don't edit the file by hand. You add it under expo.ios.privacyManifests in app.json or app.config.js. This is Expo's own example:

{
  "expo": {
    "ios": {
      "privacyManifests": {
        "NSPrivacyAccessedAPITypes": [
          {
            "NSPrivacyAccessedAPIType": "NSPrivacyAccessedAPICategoryUserDefaults",
            "NSPrivacyAccessedAPITypeReasons": ["CA92.1"]
          }
        ]
      }
    }
  }
}

Don't copy reason codes blindly. Apple says the reasons you declare "must be consistent with your app's functionality as presented to users," and you can only use the API for the reasons you declare.

Step 3: Copy reasons from your libraries

This is the step most people miss. Expo's guide says:

As of now, Apple does not correctly parse all the PrivacyInfo files included by static CocoaPods dependencies (such as Expo SDK packages and other ecosystem libraries). You may need to include the required reasons for the APIs used by those dependencies in your app's PrivacyInfo.xcprivacy file or the configuration in the app.json.

To find them:

1. Look for PrivacyInfo.xcprivacy files inside node_modules. Expo's guide says to check node_modules/package_name/ios. From your project root, find node_modules -name PrivacyInfo.xcprivacy lists them.
2. Open each one and note the NSPrivacyAccessedAPITypes entries and their NSPrivacyAccessedAPITypeReasons.
3. Add each API category and reason to your privacyManifests config. If 2 libraries use the same category, list the category once with every reason you need.

If a coding agent built your app, you can ask it to do steps 1 to 3 and show you the merged list before it edits app.json.

Expo also notes a fallback: Apple emails you after you submit a build with missing reasons, and you can copy the reasons from that email into your config.

Step 4: Rebuild and check

Run a new EAS build. If you want to see the result, run npx expo prebuild --platform ios and open ios/<YourApp>/PrivacyInfo.xcprivacy.

Expo's guide says you can test by submitting to TestFlight external review or App Review, and that "Apple will email you within a few minutes of submitting if your app is missing any required reasons for the APIs used."

The manifest is part of the app bundle, so any change here needs a new build.

Bare React Native project? Expo's guide says to create PrivacyInfo.xcprivacy in Xcode and add it to your iOS app target. Apple's steps: File > New File, pick App Privacy File under Resource, check your app target, and click Create.

Part 2: Make your App Privacy label match your SDKs

The label in App Store Connect doesn't fill itself in from your manifest. Apple's SDK page says Xcode can combine the privacy manifests from your SDKs "into a single, easy-to-use report" to help you make "more accurate Privacy Nutrition Labels." You still have to enter the answers yourself.

Firebase is a good example of why this matters. Its App Store data disclosure guide (Google's page says "Last updated 2026-11-10 UTC", fetched Nov 11, 2026) says:

Firebase's privacy manifests disclose data that is always collected and collected by default. It is your responsibility to ensure your privacy nutrition labels are accurate based on your app's actual usage of Firebase.

So the manifest only covers what the SDK does on its own. How you use the SDK can add more.

A simple audit:

1. List every SDK in your iOS build. For Expo, check package.json and the plugins in your app config. Firebase's guide warns that you may have more Firebase targets than you expect, because "some Firebase build targets have transient dependencies on others."
2. For each SDK, open its own data disclosure page. Firebase lists what each library collects. For example, its page says FirebaseCrashlytics "collects stack traces and relevant application state when an application crashes" and "collects device and OS information." FirebaseAuthentication collects email addresses when you use email sign-in.
3. Add what your own code sends to your backend: emails, names, photos, messages, location, purchase history, and so on.
4. Walk through the App Privacy questions in App Store Connect with that list. For each data type, mark whether it's linked to the user and whether it's used for tracking.

You don't need a new build to change these answers.

Part 3: Third-party AI and 5.1.2

If your app sends what people type, say, or upload to an AI service (OpenAI, Anthropic, Google, or any other model you didn't build), 5.1.2(i) says you must "clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so."

In practice, that usually means:

• Tell people before it happens. Before the first AI request, show a screen that says what gets sent (for example, "your messages and photos you attach") and who it goes to.
• Get a real yes. Use a clear button the user taps to agree. Apple's text says "explicit permission."
• Match your privacy policy. 5.1.1(i) says your privacy policy has to confirm that third parties you share data with "will provide the same or equal protection of user data." Name the AI provider there too.
• Match your label. If the data leaves the device and the provider keeps it, it likely belongs on your App Privacy label. Check Apple's definition of "collect" on the App Privacy page.
• Check your SDK, too. Firebase's guide says that if AI monitoring is turned on for its Gemini API, "the prompts and generated output from each sampled request are collected." That's the kind of detail that should show up in your disclosures.

A consent screen is app code, so adding one needs a new build.

How to reply to App Review

Say which of the 3 issues you fixed and how. Keep it short and specific. For example:

We added the required reason APIs used by our dependencies to the app's privacy manifest in build 14. We also updated our App Privacy answers in App Store Connect to include crash data and device ID from Firebase Crashlytics. Before the app sends any message to our AI provider, it now shows a screen that names the provider and what is sent, and the user must tap Agree. Our privacy policy at [link] has been updated to match.

Only list fixes you really made. If you changed only the label, say so. You don't need a new build for that part.

When ShipCheck helps vs when it doesn't

• Helps: ShipCheck's 5.1.2 check looks for privacy manifest gaps it can see in your project files. The same scan covers 15 other Apple and Google Play rules, including 5.1.1 privacy and App Tracking Transparency. See the guidelines we check.
• Doesn't help: your App Privacy label. ShipCheck can't see or fill in your App Store Connect answers. It also can't tell what your app sends to an AI service when it runs, or whether your consent screen is clear enough. Use the steps above for those.

FAQ

I got an email after uploading, not a rejection. Is that 5.1.2? Usually not. Apple's docs say App Store Connect sends an email when a required reason is missing or a manifest is invalid. That's an upload problem with the manifest. A 5.1.2 rejection comes from App Review and is about how you use and share data.

Does adding a privacy manifest update my privacy label? No. You enter the label answers in App Store Connect yourself. Xcode's privacy report can help you build the list.

Do I need App Tracking Transparency for analytics? Not always. Apple's 5.1.2 text ties ATT to tracking. Check Apple's tracking definition on the App Privacy page before you add a prompt.

Can I make my app require tracking or notifications to work? No. 5.1.2(i) says your app may not require users to turn on things like push notifications, location services, or tracking to use the app.

Is this the same as the 5.1.1 permission strings? No. Purpose strings like NSCameraUsageDescription go in Info.plist and fall under 5.1.1. See our guide on unused permissions in Expo apps.

Related guides

• Guideline 5.1.1 unused permissions in Expo and React Native
• Guideline 5.1.1(v) account deletion
• Guideline 4.8 Sign in with Apple
• Guidelines we check

Ready to resubmit? Run a free ShipCheck first. Paste a public GitHub link or upload a zip, no account needed. It names each issue with the guideline, a short label, how serious it is, and how many places. A fix is $9, or 3 for $19, paid first. Run a free ShipCheck

It still can't see your App Store Connect privacy answers or what your app sends to an AI service.