ITMS-91061 Missing privacy manifest and ITMS-91053 Missing API declaration

What the ITMS-91061 Missing privacy manifest and ITMS-91053 Missing API declaration emails mean, the usual causes, and how to fix them, from Apple's docs.

What the two emails mean

ITMS-91061: Missing privacy manifest. The email names a file in your app and says it includes an SDK that Apple's documentation identifies as a privacy-impacting third-party SDK. The email itself says that starting February 12, 2025, a new app that includes such an SDK, or an update that adds one, needs the SDK to include a privacy manifest file. The list is on Apple's third-party SDK requirements page and includes, among others, Alamofire, Firebase libraries, Flutter, and OneSignal. Any version of a listed SDK counts, and so do SDKs that repackage one. Apple also requires signatures for SDKs used as binary dependencies.

ITMS-91053: Missing API declaration. The email says your app's code in a named file references one or more APIs that require reasons, and lists the API categories. You need an NSPrivacyAccessedAPITypes entry with an approved reason for each category. Apple's docs say that starting May 1, 2024, apps that don't describe their use of required reason API in their privacy manifest file aren't accepted by App Store Connect.

Common causes

• An old version of a listed SDK, from before the provider added a privacy manifest
• A listed SDK repackaged inside another framework or static library, where the manifest did not make it into the build (Apple's list includes repackaged SDKs)
• A PrivacyInfo.xcprivacy file that is not in the right place, so it is not in the built app (for an iOS app, Apple says it goes at the root of the app bundle)
• Your own code uses a required reason API, such as UserDefaults, file timestamps, system boot time, disk space, or active keyboards, with no reason declared
• An invalid manifest: Apple's docs say App Store Connect rejects submissions with invalid privacy manifest files

How to fix ITMS-91061

1. For each SDK named in the email, update to a version that includes its privacy manifest. If none exists, ask the SDK provider.
2. Build and check that the SDK's manifest is inside the built product, not only in your source tree.
3. If your app has its own privacy manifest, it should describe only your app's practices. Apple's developer technical support says not to add the SDK's practices to it.
4. Repeat for every SDK the email names, then upload a new build.

How to fix ITMS-91053

1. Find the file named in the email. If it is one of your SDKs, update the SDK. If it is your code, continue.
2. Add a privacy manifest (PrivacyInfo.xcprivacy) to your app target if you do not have one.
3. Add an NSPrivacyAccessedAPITypes entry for each category in the email, with the approved reason from Apple's required reason API list that matches how you use it.
4. Upload a new build.

Apple's developer technical support covers this in the forum thread Handling ITMS-91061: Missing privacy manifest, which also points to technotes TN3181 to TN3184.

What to do

1. For ITMS-91061, update each SDK named in the email to a version that includes its privacy manifest
2. For ITMS-91053, add the API category and an approved reason to the privacy manifest of the code that uses it
3. Upload a new build and check that the email does not come back

Sample note

Replace the brackets with your facts and remove anything that does not apply.

Notes for Review (optional):

Build [number] updates [SDK names] to versions that include their privacy manifests (ITMS-91061), and adds required reason API declarations for [categories] to the app's privacy manifest (ITMS-91053).

Questions developers ask

Still stuck?

More App Review help

Sources: Third-party SDK requirements · Privacy manifest files · Describing use of required reason API · Handling ITMS-91061 (Apple Developer Forums). Last checked Oct 26, 2026. Always read Apple's current documentation.