How iOS 15 App Privacy Report Logs Tracking Domains

Apple's iOS 15 introduces the App Privacy Report, a built-in auditing tool that provides detailed transparency into how installed applications access private data and communicate over the internet. This article explains how the system monitors outgoing network traffic, identifies third-party tracking domains, and correlates this activity across multiple apps to give users an accurate picture of cross-app data sharing.

Local Network Monitoring

The App Privacy Report functions directly within the iOS networking stack. Whenever an app makes an outbound connection—whether to download content, send analytics, or serve an advertisement—the operating system logs the event locally on the device. This process operates at the system level, meaning apps cannot bypass, hide, or alter the connection logs. The device records the destination domain, the exact timestamp, and the specific application bundle identifier that initiated the call.

Identification of Third-Party Domains

Applications rarely rely solely on their own servers; developers frequently integrate third-party Software Development Kits (SDKs) for monetization, crash analytics, and user tracking. When an app launches or executes code that triggers one of these SDKs, a network call is dispatched to the third party's remote server.

iOS categorizes these connections into two distinct views:

• App Network Activity: Lists the specific domains contacted by an individual application.
• Website Network Activity: Lists domains loaded through in-app web browsers (such as Safari View Controller).

Correlating Data Across Different Apps

The key mechanism for detecting cross-app tracking lies in the Most Contacted Domains section of the report. The operating system aggregates all logged connections over a rolling seven-day window and groups them by domain name rather than by app.

When multiple unrelated apps contain the same third-party tracking framework (such as an ad exchange or cross-platform analytics service), they all ping the same host servers. iOS detects this overlapping activity and surfaces a compiled list showing how many different applications have contacted that specific domain. For example, if three separate utility apps and two games all send requests to the same ad-tracking server, the report explicitly attributes that single domain to all five applications.

Privacy and Data Storage

All data processed for the App Privacy Report is stored locally on the user's device in an encrypted state and is not shared with Apple. Users can export this raw data as an NDJSON file to inspect individual network requests, IP endpoints, and timestamps in granular detail. This gives users concrete evidence of which third-party entities are actively profiling them across distinct apps without requiring specialized network-sniffing hardware.