How App Privacy Report Logs Network Activity on iOS 15

Apple’s App Privacy Report in iOS 15 provides transparency into how installed applications interact with remote servers by logging every outbound network connection. This article explains the technical mechanics behind how iOS 15 monitors, attributes, and stores these network domain requests, detailing the operating-system-level interception methods, privacy safeguards, and logging architectures used without compromising performance or user security.

System-Level Network Interception

The App Privacy Report does not rely on applications voluntarily reporting their own network calls. Instead, logging occurs at the operating system level beneath the application sandbox. When an app initiates a connection using system frameworks—such as URLSession, Network.framework, WebKit, or lower-level BSD sockets—the request passes through the iOS networking stack.

At this layer, the system intercepts network operations, specifically monitoring Domain Name System (DNS) queries and socket creations. Whenever an app triggers a DNS resolution to translate a human-readable domain (such as api.example.com) into an IP address, iOS records the event.

Attribution via Process Identifiers

To determine which app is responsible for a network call, the operating system tracks the calling process:

  • Direct Connections: When an app directly makes an API call, the network stack identifies the app’s unique bundle identifier (e.g., com.developer.app) associated with the active process.
  • Embedded Web Views and Third-Party SDKs: Third-party trackers and advertising frameworks embedded within an app run inside that app’s process space. Consequently, any network requests initiated by these SDKs are attributed directly to the host app.
  • In-App Web Browsing: For web content loaded via SFSafariViewController, the system distinguishes between interactions driven explicitly by user website navigation and background calls made directly by the host application.

Data Logged vs. Data Excluded

To maintain user privacy while tracking app behavior, the logging mechanism strictly limits the scope of recorded data:

  • What is logged: The system records the Fully Qualified Domain Name (FQDN) contacted, the timestamp of the connection, and the bundle identifier of the initiating application.
  • What is excluded: The App Privacy Report does not record full Uniform Resource Locators (URLs), query parameters, HTTP headers, request payloads, or encrypted traffic contents. This prevents sensitive user inputs, session tokens, or personal identifiers from being exposed in the log.

On-Device Storage and Aggregation

All network logging is processed and stored entirely on the device. When the feature is enabled in Settings > Privacy > App Privacy Report, iOS writes events to an internal, encrypted rolling database managed by system daemons.

The report maintains a 7-day rolling window of activity. Events older than seven days are automatically purged. Because all logging and parsing happen locally, Apple does not receive or review the recorded network requests. Users can inspect the aggregated results directly through the native Settings interface or export the raw data as an NDJSON (Newline Delimited JSON) file for third-party auditing and deeper technical analysis.