Which React Native libraries require a privacy manifest?

Apple publishes a list of 86 commonly used third-party SDKs that require both a privacy manifest and a signature. The ones that commonly appear in React Native and Expo projects include hermes, the Firebase family, the Facebook SDK, GoogleSignIn, GoogleUtilities, OneSignal, SDWebImage, Lottie, Alamofire, AFNetworking, RealmSwift, the RxSwift family, OpenSSL, Protobuf and nanopb.

Why can't my app's privacy manifest cover its dependencies?

Apple requires that for each executable or dynamic library using a required reason API, the bundle containing that executable or library includes its own privacy manifest. A third-party SDK cannot rely on the app's manifest.

Which of your dependencies need a privacy manifest?

Updated September 4, 2026 · compiled from Apple's published SDK list

Apple lists 86 commonly used third-party SDKs that require both a privacy manifest and a signature. The table below is that list filtered to the entries that actually turn up in React Native and Expo dependency trees.

Start with the first row. hermes is on Apple's list, and Hermes is React Native's default JavaScript engine — so this affects almost every RN app, and almost nobody knows it.

The RN/Expo-relevant entries

SDK	What it is	How it gets into your project
`hermes`	React Native's default JS engine	Ships in virtually every RN app. The one nobody expects.
`Flutter`	Cross-platform framework	Only if embedded in a hybrid app.
`FBSDKCoreKit / FBSDKLoginKit / FBSDKShareKit`	Facebook SDK	Pulled in by react-native-fbsdk-next.
`FBAEMKit / FBLPromises / FBSDKGamingServicesKit`	Facebook SDK support libs	Transitive dependencies of the above.
`Firebase (13 listed entries)`	Firebase suite	Analytics, Crashlytics, Messaging, Firestore etc. via @react-native-firebase/*.
`GoogleSignIn`	Google sign-in	Via @react-native-google-signin/google-signin.
`GoogleUtilities / GTMSessionFetcher / GTMAppAuth`	Google support libs	Transitive under Firebase and GoogleSignIn.
`OneSignal / OneSignalCore / OneSignalOutcomes`	Push notifications	Via react-native-onesignal.
`OpenSSL / BoringSSL / openssl_grpc`	Crypto	Transitive under Firebase and gRPC.
`Protobuf / nanopb`	Serialisation	Transitive under Firebase.
`SDWebImage`	Image loading	Transitive under several image libraries.
`Lottie`	Animations	Via lottie-react-native.
`RealmSwift`	Database	Via realm.
`RxSwift / RxCocoa / RxRelay / RxLibrary`	Reactive	Transitive under various native modules.
`Alamofire / AFNetworking`	HTTP	Transitive under older native modules.
`Kingfisher`	Image loading	Occasional transitive dependency.
`Reachability`	Network status	Via @react-native-community/netinfo in some versions.
`SnapKit / Starscream / SwiftyJSON / Toast`	Assorted iOS libs	Transitive under various native modules.
`leveldb / FMDB`	Storage	Transitive under Firebase and SQLite modules.
`Charts`	Charting	Via charting wrappers.
`Capacitor / Cordova`	Hybrid frameworks	Only in hybrid apps.
`UnityFramework`	Unity	Embedded Unity content.

Compiled from Apple's third-party SDK requirements page, which is the authoritative list and changes over time. Check it directly before you rely on this table — and note that Apple's requirement triggers when you submit a new app, or an update that adds a listed SDK.

Why the "how it gets in" column matters most

Look at how many of those rows say transitive. You did not install nanopb. You installed Firebase, which installed gRPC, which installed nanopb. You did not install GTMSessionFetcher — GoogleSignIn did.

This is the actual shape of the problem. Apple's rule is per-bundle: from the privacy manifest documentation, "For each executable or dynamic library in an app that uses a required reason API, the bundle that includes the executable or dynamic library needs to include a privacy manifest file." Your app's manifest does not cover your dependencies, and your dependencies were mostly not chosen by you.

What Expo tells you to do about it

Expo's Apple privacy guide states that "Apple does not correctly parse all the PrivacyInfo files included by static CocoaPods dependencies," and recommends manually walking node_modules for PrivacyInfo.xcprivacy files and aggregating the values yourself.

That is the honest state of the art: hand-auditing a tree of several hundred packages, against a list Apple updates, before every submission. Expo also flags its own guide as still in development.

A rough first pass you can run yourself

This won't replace a real audit, but it tells you in a few seconds which of your installed packages already ship a manifest:

find node_modules -name "PrivacyInfo.xcprivacy" | sed 's|node_modules/||' | cut -d/ -f1 | sort -u

Then compare that against Apple's list. The gap between "on Apple's list" and "ships a manifest in your tree" is where your submission fails.

The deadline, and what it means now

From Apple's documentation: "Starting May 1, 2024, apps that don't describe their use of required reason API in their privacy manifest file aren't accepted by App Store Connect." This is not upcoming — it has been enforced for over two years. If you are shipping an RN app today without having audited this, you are relying on your dependencies having sorted it out for you.

We deliberately do not list reason codes on this site. Apple renders those tables client-side, and secondary copies circulate with errors. A wrong reason code produces a rejection that looks like a fixed problem — the worst possible failure mode. Read them from Apple's page directly.

The full privacy manifest explainer — the four manifest keys, the five required-reason categories, and how Expo config handles it.

Verify against Apple before you act. Every guideline quotation here is linked to Apple's own page. The guidelines are a living document that Apple changes without notice — read the source, don't trust a cached copy.

Cite this page

shipcheck. "Which of your dependencies need a privacy manifest?." Baker Ventures LLC, September 4, 2026. https://shipcheck.bakerventuresstudio.com/rejections/react-native-sdks-needing-privacy-manifests

Sources