The React Native privacy-manifest census

The numbers

Download the full dataset as JSON. CC BY 4.0.

The 22 that ship one

The pattern is legible: they cluster on packages touching an obvious permission surface, such as notifications, media library, camera roll, device info, permissions and the file system. Those are the teams for whom the requirement was unmissable.

react-native itself ships one, which matters more than any other row here. hermes, React Native's default JavaScript engine, is on Apple's third-party SDK list, so this requirement touches essentially every React Native app rather than only those using Firebase or Facebook.

The most popular 30 that do not

Ranked by npm's own popularity score. 179 packages with native iOS code ship no manifest of their own.

Read this list carefully rather than alarmingly. Several of these plausibly use no required-reason API at all, and a package can also be covered by a manifest inside a pod it depends on rather than in its own published tree. The list tells you where to look. It does not tell you what you will find.

Why the per-bundle rule makes this your problem

Apple's wording is that for each executable or dynamic library in an app that uses a required reason API, the bundle that includes it needs to include a privacy manifest file. And a third-party SDK "can't rely on the privacy manifest files for apps that link the third-party SDK."

Both halves matter. You cannot declare on a dependency's behalf, and the dependency cannot lean on you. So when a dependency that needs a manifest does not ship one, the options are upstream: update it, fork it, replace it, or remove it. That is why an ITMS-91061 email names a framework you have never installed. ITMS-91061 in detail.

What to do with this

# what your own tree already carries
find node_modules -name "PrivacyInfo.xcprivacy" | sed 's|node_modules/||' | cut -d/ -f1 | sort -u

# what actually resolved into the iOS build, transitives included
grep -E '^ +- ' ios/Podfile.lock | sed 's/[ -]*//' | cut -d' ' -f1 | sort -u

Podfile.lock is the ground truth, because it holds what was resolved rather than what you asked for. Intersect it with Apple's 86-SDK list mapped to npm packages, and this census tells you which of the rest have done the work.

Method, and its limits

Population. The most-depended-upon React Native packages per the npm registry search API's popularity ranking. Not a random sample, and deliberately so: these are the packages a developer is most likely to install.

Denominator. Only packages shipping native iOS code, detected by a .podspec, an ios/ directory, or Swift and Objective-C sources. A JS-only package cannot use a required-reason API from a bundle of its own, and counting it as missing a manifest would inflate the problem. An earlier run of this script matched .m as a substring, which also matched readme.md, and reported 20 of 20 packages as native including one with three files. The denominator is the number most easily got wrong, and getting it wrong flatters the headline.

Detection. A file named PrivacyInfo.xcprivacy anywhere in the published tarball, via the jsDelivr file-tree API. Presence, not correctness.

Reproduce it. scripts/rn_privacy_census.py in the source repository. The dataset carries its measurement date; re-run it and the number will move.

Questions and answers