Apple privacy manifest updates for Unity Engine

[iiCaptain]

@JuliusM

Requirement to provide Privacy Manifest
The latest Unity Editor versions can already handle Privacy Manifests and also automatically add most of Required Reasons for APIs used within Unity Engine core. We still need to add reason 35F9.1 to the Privacy Manifest, which we expect to be done in Unity 2023.2.13, 2022.3.21 and 2021.3.36. The release notes will state “Added missing privacy manifest entry for System Boot time API usage”.

We will keep you updated.

Looks like 2023.2.13, 2022.3.21 and 2021.3.36 were released March 5th

Download Archive

[GustavNinja]

I can confirm that 35F9.1 was added in the latest release. Also the function of merging several Privacyinfo files was added as well.

[JuliusM]

Hello everyone,

We have some updates after our discussions with Apple.

• We have confirmation that UnityFramework does not need to be signed and Unity Engine core libraries can remain in UnityFramework without being signed. We will continue to investigate the feasibility of signing the Engine core libraries as a separate feature, no longer tied to the current privacy requirements from Apple.
• UnityFramework will still be included in the “commonly used third-party SDK” list on Apple’s side as we need to comply with the privacy manifest requirements.

Apple has published an update with deadlines for compliance. Starting March 13, Apple will start sending out email notifications for missing reasons in the app’s privacy manifest and if not addressed, this will prevent app updates starting May 1.

Apple states you are responsible for all code included in your apps. When uploading an app, Apple requires you to declare your first-party collected data, provide reasons for your own usage of the required reasons APIs and ensure newly added commonly used third-party SDKs and frameworks comply with Apple’s privacy requirements.

If you get notified about missing reasons or signatures, you have to declare your own reasons and / or update third-party dependencies to versions which meet Apple’s requirements.

What does this mean for updates of already published apps?

All apps made with Unity Editor contain UnityFramework. Based on the current requirements, such apps published before Spring 2024 can be updated without including reasons for the required reason APIs used by the Unity Engine core. This means you could continue to use older Unity Editor versions for now. Please bear in mind Apple may change their third-party SDK requirements in the future, so we strongly recommend to upgrade to Unity version 2021.3.36f1, 2022.3.21f1, 2023.2.13f1 or newer, which

• automatically handles privacy manifests from Unity packages and plugins included in your project
• declares reasons for the required reason APIs used by the Unity Engine core

[kontaka3]

@JuliusM

If you are a Plugin/Package/SDK owner

You may be providing a service or package to be included inside a Unity project. Examples: an ad network, social network, or Asset Store package that contains code. Below are our suggestions based on your product delivery type. Our documentation page includes these instructions as well.

My product is delivered as a .framework

Steps:

• Audit Required Reasons API usage

• Examine any native code, or native library of yours for usage.

• (if applicable) Audit your SDKs privacy practices [Apple Docs] for data use and collect this information.

• Include the above information in your framework’s privacy manifest file as directed by Apple.

• Release a new version of your SDK Framework.

My product is NOT delivered as a .framework

Consider delivering your product as a .framework.
If this is not possible:

• Audit Required Reasons API usage.

• Examine any native code, or native library of yours for usage.

• Examine your C# code - are you using any calls from this list.

• You will need to add your reasons for calling any API either within the native or the C# space.

• (if applicable) Audit your privacy practices [Apple Docs] for data use.

• Create a Privacy Manifest in Xcode and include the above information in the privacy manifest file.

• Save it inside your plugin folder eg Plugins/.xcprivacy file. In latest versions of Unity Editor 2021, 2022 and 2023 this file is merged into the Unity Framework Privacy Manifest during export.

• Release a new version of your Plugin/Package.

I provide a package that includes a .xcframework to be incorporated into a Unity project. I understand that Unity currently doesn’t support the xcframeworks that are compliant with Privacy Manifest (an xcframework that contains .xcprivacy and is signed with an Apple Distribution certificate). Is there any particular reason for this?
Dose Unity have any plans to support it in the future?

when I use a Privacy Manifest compliant xcframework and import it into my Unity project, meta files are generated inside the xcframework. This causes the signature verification to fail when building with Xcode, leading to a build failure.

[rytis_unity]

@kontaka3 Hey,
We plan to support .xcframework in the near future, but I don’t have an ETA. The changes are rather simple, xcframeworks will function the same as frameworks.

[kontaka3]

@rytis_unity

@kontaka3 Hey,
We plan to support .xcframework in the near future, but I don’t have an ETA. The changes are rather simple, xcframeworks will function the same as frameworks.

@rytis_unity
Thank you very much for your reply.
I understand it.

[mii47]

If we are unable to update UnityEditor for some reason, can we simply add PrivacyManifest manually?

[makaka-org]

@mii47

If we are unable to update UnityEditor for some reason, can we simply add PrivacyManifest manually?

You can use just this point after building from Unity and without adding the file to the Unity Project.

@JuliusM

5. Create a Privacy Manifest in Xcode and include the above information in the privacy manifest file.

To exclude doing this every new build, I believe that you can automate your routine using [PostProcessBuild(0)] attribute for operational method like in this my example for App Encryption Documentation, but for Privacy Manifest file in your case.

[mii47]

@makaka-org

You can use just this point after building from Unity and without adding the file to the Unity Project.

To exclude doing this every new build, I believe that you can automate your routine using [PostProcessBuild(0)] attribute for operational method like in this my example for App Encryption Documentation, but for Privacy Manifest file in your case.

Thanks!
I’ll refer you to it.

[vn_man]

I use Unity 2023.1.3f1 and my app not use any API in list Required Reasons APIs
so what exactly work I have to do for build and public ios?
thank!

[Voxel-Busters]

@vn_man

I use Unity 2023.1.3f1 and my app not use any API in list Required Reasons APIs
so what exactly work I have to do for build and public ios?
thank!

If you don’t have any usage of api methods which fall under required reasons api, just fill in nutrition labels (NSPrivacyCollectedDataTypes) entry list in the privacy manifest. If you have no data collected or used, just do nothing!

[Voxel-Busters]

@""

Hi @rytis_unity @JuliusM and unity folks,

There are few games in my single Unity project. I am using Photon Pun2 for some of the game. I have the 2000 CUU subscription of PUN2. Now I want to make a game using Photon Quantum within the same project. So I want know

1. Is it possible to keep Pun2 and Quantum sdk/plugin in a single project?
2. Do I need new account or subscription for Quantum?
3. Initialization/Settings of photon server, do I need to setup everything separately for both?
4. security wise, which is more secure Pun2 or Quantum?
   I have been searching around this but found nothing. Please help in advance.
   Thanks!

You should post this on Photon’s discord for help.

[unity_01C950CF7925D7707808]

We use SharpZipLib package provided by Unity: Changelog | SharpZipLib | 1.3.8

Which is a wrapper on top of the original SharpZipLib Lib: GitHub - icsharpcode/SharpZipLib: #ziplib is a Zip, GZip, Tar and BZip2 library written entirely in C# for the .NET platform.

This contains C# File and Directory API that come under Required Reasons API.

Any plans to update this?

( @rytis_unity @JuliusM )

[pixelsprite_unity]

Thank you for flagging this; we have raised it internally.

[unity_65869D18C87D542F36E1]

Hey guys, I’m currently using bunch of analytics SDKs in my game from which some are of older version for them I created a privacy file in Assets/Plugins and added their privacy API reasons and DataTypes from their release commits on git. The problem is that I’m still getting “NSPrivacyAccessedAPICategoryFileTimestamp” API missing warning. I’ve event tried to add all of the reasons in the file, I’m still getting the same warning. Kindly let me know what I’m doing wrong here. Thanks.

[Voxel-Busters]

@unity_65869D18C87D542F36E1

Hey guys, I’m currently using bunch of analytics SDKs in my game from which some are of older version for them I created a privacy file in Assets/Plugins and added their privacy API reasons and DataTypes from their release commits on git. The problem is that I’m still getting “NSPrivacyAccessedAPICategoryFileTimestamp” API missing warning. I’ve event tried to add all of the reasons in the file, I’m still getting the same warning. Kindly let me know what I’m doing wrong here. Thanks.

Once you make the XCode project, open the exported folder and navigate to UnityFramework folder.
Over there you can see both .xcprivacy file along with “ApplePrivacyManifestsMerge.txt” file. It contains the log on how the unity merged the different privacy manifest files provided in the unity project. That might help you.

Let us know what you found out!

[pixelsprite_unity]

@unity_01C950CF7925D7707808

We use SharpZipLib package provided by Unity: https://docs.unity3d.com/Packages/com.unity.sharp-zip-lib@1.3/changelog/CHANGELOG.html

Which is a wrapper on top of the original SharpZipLib Lib: https://github.com/icsharpcode/SharpZipLib

This contains C# File and Directory API that come under Required Reasons API.

Any plans to update this?

Quick comment to say this should have an update pretty soon.

[gelllard]

I’ve got the mail from Apple with list of API. I found ApplePrivacyManifestsMerge.txt file and there are all API from apple’s mail. Does it mean that Privacy Manifest contains all required API? Why did I get the warning?

I have not my own manifest at all, by the way.

Adding elements from Unity
    NSPrivacyCollectedDataTypes:
        <empty>

    NSPrivacyAccessedAPITypes:
        0:
            NSPrivacyAccessedAPIType:
                NSPrivacyAccessedAPICategorySystemBootTime
            NSPrivacyAccessedAPITypeReasons:
                0:
                    35F9.1
        1:
            NSPrivacyAccessedAPIType:
                NSPrivacyAccessedAPICategoryDiskSpace
            NSPrivacyAccessedAPITypeReasons:
                0:
                    E174.1
        2:
            NSPrivacyAccessedAPIType:
                NSPrivacyAccessedAPICategoryUserDefaults
            NSPrivacyAccessedAPITypeReasons:
                0:
                    CA92.1
        3:
            NSPrivacyAccessedAPIType:
                NSPrivacyAccessedAPICategoryFileTimestamp
            NSPrivacyAccessedAPITypeReasons:
                0:
                    0A2A.1
                1:
                    C617.1

[Voxel-Busters]

@gelllard

I’ve got the mail from Apple with list of API. I found ApplePrivacyManifestsMerge.txt file and there are all API from apple’s mail. Does it mean that Privacy Manifest contains all required API? Why did I get the warning?

I have not my own manifest at all, by the way.

Adding elements from Unity
    NSPrivacyCollectedDataTypes:
        <empty>

    NSPrivacyAccessedAPITypes:
        0:
            NSPrivacyAccessedAPIType:
                NSPrivacyAccessedAPICategorySystemBootTime
            NSPrivacyAccessedAPITypeReasons:
                0:
                    35F9.1
        1:
            NSPrivacyAccessedAPIType:
                NSPrivacyAccessedAPICategoryDiskSpace
            NSPrivacyAccessedAPITypeReasons:
                0:
                    E174.1
        2:
            NSPrivacyAccessedAPIType:
                NSPrivacyAccessedAPICategoryUserDefaults
            NSPrivacyAccessedAPITypeReasons:
                0:
                    CA92.1
        3:
            NSPrivacyAccessedAPIType:
                NSPrivacyAccessedAPICategoryFileTimestamp
            NSPrivacyAccessedAPITypeReasons:
                0:
                    0A2A.1
                1:
                    C617.1

For the required reason api (methods) listed in the email, do a text search in the exported xcode project to see if anything is missed.

[unity_65869D18C87D542F36E1]

@Voxel-Busters

Once you make the XCode project, open the exported folder and navigate to UnityFramework folder.
Over there you can see both .xcprivacy file along with “ApplePrivacyManifestsMerge.txt” file. It contains the log on how the unity merged the different privacy manifest files provided in the unity project. That might help you.

Let us know what you found out!

Thanks for responding. I’ve tried to resolved it but it’s still sending the warning email, I’ve event tried adding the combination the reasons and even all of the reasons as well but same results. Is it possible that it’s because of Unity Cloud Build as we are generating builds from it and uploading it to app store? Maybe that’s the problem?