How iOS 15 App Privacy Report Logs App Tracking

Apple introduced the App Privacy Report in iOS 15 to give users visibility into how installed applications access sensitive permissions and communicate over the internet. This feature logs every outbound network request made by an app, categorizing these interactions to highlight connections to third-party domains, advertising networks, and data brokers. This article explains the technical mechanisms behind how iOS 15 monitors, classifies, and records these network connections directly on your device.

On-Device Network Monitoring

The App Privacy Report functions at the system level rather than relying on apps to self-report their behavior. When an application initiates an outbound connection—whether to fetch content, send analytics, or load an advertisement—the request passes through the operating system's networking stack (such as CFNetwork and Network.framework).

iOS captures these outbound connections at the socket and DNS resolution levels. By monitoring traffic internally, the system captures all activity initiated by:

  • The core application code.
  • Embedded third-party software development kits (SDKs) used for analytics, crash reporting, or monetization.
  • In-app web views that load external web content.

DNS Query Logging and Domain Identification

Rather than inspecting the encrypted payload of network requests (which are typically secured via HTTPS), iOS 15 monitors the destination hostnames.

When an app resolves an address via a DNS query, the operating system logs:

  1. The initiating application: The exact bundle identifier making the request.
  2. The contacted domain: The Fully Qualified Domain Name (FQDN), such as analytics.exampletracker.com.
  3. The timestamp: The precise date and time the connection occurred.

Because this logging happens via system calls, installed applications cannot obscure the destination server from the operating system, even if the data stream inside the connection is encrypted.

Distinguishing First-Party vs. Third-Party Domains

To determine whether a connection is direct or third-party, iOS evaluates the relationship between the app and the destination domain.

  • First-Party Domains: If the contacted server shares ownership, a primary domain name, or verified organizational roots with the app developer, the connection is typically treated as first-party activity required for core functionality.
  • Third-Party Domains: If an app communicates with a server operated by a different entity—such as advertising exchanges, social media trackers, or analytics platforms—iOS flags the contact as a third-party interaction. The system cross-references these domain names with known advertising and tracker registries.

Local Data Aggregation and Storage

To protect user privacy, the App Privacy Report operates entirely on-device without sending telemetry back to Apple.

The system retains a rolling 7-day log of all permission accesses and network activities. These entries are stored in a secure local database. When a user exports their data, iOS compiles it into a raw Newline Delimited JSON (NDJSON) file, detailing every unique domain interaction, the calling process, and whether the connection occurred while the app was actively in use or running in the background.