Open Radar

 
My app, until now, has used AdMob for ads, and thus of course included NSUserTrackingUsageDescription. Now I have removed AdMob from my app and uploaded a new binary and submitted it for review.

A few hours later, my binary was rejected, with the following explanation:

Guideline 5.1.2 - Legal - Privacy - Data Use and Sharing

The app privacy information you provided in App Store Connect indicates you collect data in order to track the user, including Advertising Data. However, you do not use App Tracking Transparency to request the user's permission before tracking their activity.

Starting with iOS 14.5, apps on the App Store need to receive the user’s permission through the AppTrackingTransparency framework before collecting data used to track them. This requirement protects the privacy of App Store users.

“Next Steps”
Here are two ways to resolve this issue:
- If you do not currently track, or decide to stop tracking, update your app privacy information in App Store Connect. You must have the Account Holder or Admin role to update app privacy information.
- If you track users, you must implement App Tracking Transparency and request permission before collecting data used to track. When you resubmit, indicate in the Review Notes where the permission request is located."

Yet, if I navigate to the "App Privacy" page in App Store Connect and uncheck the "Advertising Data" disclosure, I receive the following message:
"Your app contains NSUserTrackingUsageDescription, indicating that you will request permission to track users. You must indicate which data types are tracking users. If this is incorrect, update your app binary and upload a new build to App Store Connect."

This is a bug. I am facing the same exact issue outlined in these two Apple Developer Forum threads:

Cannot remove App Privacy after removing AdMob and tracking:
https://developer.apple.com/forums/thread/679585?login=true&page=1#684575022

Can not update your app privacy information about tracking user:
https://developer.apple.com/forums/thread/678920?page=2

Please help me overcome this issue. Thank you.

“Please list the steps you took to reproduce the issue:”
1. Launch an app on the App Store that includes AdMob and the App Tracking Transparency module along with NSUserTrackingUsageDescription; configure App Privacy section in App Store Connect appropriately. App is ready for sale.
2. Upload a new binary with all traces of Admob, ATT and NSUserTrackingUsageDescription removed.
3. Binary is rejected, citing that your app contains NSUserTrackingUsageDescription, and you must either (a) include ATT, or (b) remove "Advertising Data" from your App Privacy disclosures.
4. You attempt to go to App Privacy and remove "Advertising Data" from your App Privacy disclosures, but you can't.
5. Resubmit your binary, appeal it, submit a bug report, and hope for the best.
What did you expect to happen?
Most things in App Store Connect look to binary associated with the next pending release. Like if I change the App Name, App Store Connect says "no problem, your new app name will be reviewed and made public along with your next release of the app when that is approved".

That's the way it should be with the App Privacy page.

“What actually happened?”
Instead, because of this bug, the App Privacy page appears to look at the release that's live on the app store. Since it sees NSUserTrackingUsageDescription in the binary that's live on the app store, it is impossible for a user to remove "Advertising Data" from their App Privacy page without intervention from Apple technical support representatives. Since apps are rejected if their binary doesn't match the App Privacy disclosures, users are stuck.

**Update September 1, 2021: I was successfully able to overcome this issue for myself via an appeal with the App Review Board, but I have no reason to believe the underlying bug is fixed.

I have been going back and forth with the feedback team to provide  more detail and insist to them that the issue should not be considered resolved just because I was able to get around it with ARB’s intervention.