How iOS 15 App Privacy Report Logs Background Data

Apple's iOS 15 introduced the App Privacy Report, an integrated diagnostic tool designed to give users visibility into how third-party applications interact with system permissions and external networks. This article explains the technical mechanics behind how iOS 15 detects, records, and categorizes network connections—specifically cellular data requests—initiated by applications running in the background, as well as how users can review and analyze this data.

System-Level Network Monitoring

The App Privacy Report does not rely on applications reporting their own activity. Instead, it operates directly within the iOS networking stack. Whenever an app makes an outbound connection—whether over Wi-Fi or cellular networks—it uses standard iOS networking frameworks such as NSURLSession or lower-level sockets via CFNetwork.

Because these frameworks are managed by the operating system, iOS intercepts each network transaction at the kernel and network-daemon level. The system tags the connection with the application’s unique identifier (Bundle ID) and logs the event independently of the application's consent or awareness.

Detecting Background Execution

iOS maintains distinct operational states for apps: Active (foreground), Suspended, and Background execution. When an app receives background processing time—via Background App Refresh, silent push notifications, or background audio sessions—the operating system logs its runtime state.

When an app attempts a network connection while in any state other than Active:

  1. State Tagging: The OS flags the request as originating from a background process.
  2. Interface Identification: The system checks the active routing interface, identifying whether the request traverses a cellular interface (pdp_ip0) or a local Wi-Fi interface (en0).
  3. Domain Resolution: iOS logs the fully qualified domain name (FQDN) contacted, capturing the endpoint resolved through system DNS.

Data Logged During Cellular Requests

For every cellular network request made by a background application, the App Privacy Report records specific metadata over a rolling seven-day window:

  • Target Domain: The exact web domain or IP address the app attempted to contact (e.g., analytics endpoints, content servers, or tracking domains).
  • Timestamp: The exact date and time the connection was established.
  • Context (Foreground vs. Background): Whether the screen was on and the app was actively in use, or if the connection happened while the device was locked or another app was active.
  • Website Network Activity: In-app browser connections and web trackers embedded inside views.

The report does not perform deep packet inspection. It does not read, decrypt, or log the actual payload or sensitive contents of the data transmitted; it strictly logs the network metadata (who was contacted, when, and from what state).

Accessing and Inspecting the Logs

Users can inspect logged cellular and background activity through the native interface or via exported raw data:

  1. Viewing in Settings: Navigate to Settings > Privacy > App Privacy Report. Under the App Network Activity section, select a specific app to view a chronological list of domains contacted and the frequency of those requests.
  2. Exporting Raw Data: Tapping Export App Privacy Report generates a newline-delimited JSON (.ndjson) file. Within this file, entries labeled under networkActivity include fields such as bundleID, domain, timeStamp, and execution context flags, allowing for detailed auditing of background data consumption.

All logging is processed on-device and encrypted within system storage, ensuring that logged network activity is never transmitted to Apple or external third parties.