Export App Privacy Report Logs on iOS 15

Apple introduced the App Privacy Report in iOS 15 to give users visibility into how often applications access sensitive permissions and contact network domains. This article explains how iOS 15 exports these user access logs, detailing the file generation process, the data format used, and how to inspect the exported records.

How to Trigger the Log Export

To export the log data natively on an iPhone or iPad running iOS 15:

  1. Open the Settings app.
  2. Scroll down and tap Privacy.
  3. Select App Privacy Report at the bottom of the list (ensure the feature is toggled on and has gathered data).
  4. Tap the Export App Privacy Report button located at the top or bottom of the screen.
  5. The standard iOS Share Sheet will open, allowing you to save the file to the Files app, send it via AirDrop, or share it via email or messaging apps.

The Export Format: NDJSON

When you export the report, iOS generates a file typically named AppPrivacyReport.ndjson.

Unlike standard JSON files that store an entire dataset within a single array or object, Newline Delimited JSON (NDJSON) stores each log entry as an independent, valid JSON object on a separate line. This format allows devices to stream and append continuous privacy events without having to rewrite or parse an entire file each time a new log entry is created.

Data Contained in the Access Logs

The exported NDJSON file categorizes events into distinct object types. Each line contains specific fields, including an event type identifier, timestamps, and application bundle identifiers. The primary log types include:

  • Data and Sensor Access (access): Logs instances where an app accessed hardware sensors or user data. This includes access to the camera, microphone, location services, contacts, photos, and media library. Each entry specifies the exact timestamp and whether the access occurred while the app was in the foreground or background.
  • App Network Activity (networkActivity): Details every domain an app has contacted, including the exact domain name, the initiating app's bundle ID, and timestamps.
  • Website Network Activity (webNetworkActivity): Tracks domains contacted through web views inside applications (such as in-app browsers) and Safari.

Viewing and Analyzing the Exported Logs

Because the exported data is raw NDJSON, it is not formatted for human reading out of the box. Users can inspect the raw text using any code or text editor, or process it using custom scripts (such as Python or jq). Alternatively, several open-source privacy visualizers and third-party desktop tools can ingest the .ndjson file to generate readable graphs and chronological timelines of app activity.