How iOS 15 App Privacy Report Reveals Tracking

Apple introduced the App Privacy Report in iOS 15 to give users unprecedented transparency into how mobile applications access sensitive device permissions and share data with external servers. This built-in security dashboard logs seven days of app behavior, explicitly detailing when apps access personal sensors and which third-party domains they contact in the background. The following breakdown explains how the feature detects external data connections, categorizes tracking behavior, and empowers users to identify hidden tracking practices.

How the Feature Detects and Logs Activity

The App Privacy Report functions as a passive monitor embedded in the iOS operating system. Once enabled, it records every network call and permission request executed by your installed apps over a rolling seven-day window. It segments this telemetry into distinct categories that separate benign, on-device operations from off-device data transmissions.

Monitoring Sensor and Data Access

The top section of the report logs direct access to high-risk device sensors and personal databases. It records exact timestamps for when an app accesses:

  • Location (Precise or Approximate)
  • Camera and Microphone
  • Photos and Media Library
  • Contacts

By tracking these accesses, users can determine if an app is pulling personal data at moments when the app is not actively in use or when the requested data is irrelevant to the app's core functionality.

Exposing Third-Party Network Activity

The primary mechanism for exposing data tracking lies in the App Network Activity and Most Contacted Domains sections. Whenever an app makes an outbound connection over the internet, iOS logs the exact domain name being contacted.

  1. Direct App Domains vs. Third-Party Trackers: When you use an app, it naturally communicates with its own servers (first-party activity). However, many developers integrate software development kits (SDKs) from data brokers, advertising networks, and analytics providers. The App Privacy Report displays these third-party domains distinctly. If a utility or gaming app contacts domains owned by tracking companies, ad networks, or social media platforms, those addresses appear directly under that app's profile.
  2. Website Network Activity: This metric shows domains contacted by web content loaded inside an app, such as in-app browsers. It highlights whether external trackers are embedded within web pages you visit through social media or news apps.
  3. Most Contacted Domains: This aggregated list compiles the domains contacted across all apps on the device. Common tracking and advertising endpoints frequently rise to the top of this list, clearly illustrating which third parties receive pings from multiple apps installed on your phone.

How to Enable and View the Report

The App Privacy Report is turned off by default to conserve resources until requested by the user.

  1. Open the Settings app on iOS 15 or later.
  2. Scroll down and tap Privacy (or Privacy & Security).
  3. Scroll to the bottom and select App Privacy Report.
  4. Tap Turn On App Privacy Report.

After normal device usage over a few days, the dashboard populates with network and permission logs.

Using the Data to Mitigate Tracking

The data provided by the App Privacy Report allows users to take targeted action against aggressive data collection:

  • Audit App Tracking Transparency (ATT): If an app frequently contacts advertising endpoints despite asking not to be tracked, you can verify your settings under Settings > Privacy > Tracking to ensure permissions are fully revoked.
  • Revoke Unnecessary Permissions: If the report reveals that an app accesses your location or contacts more often than expected, you can disable those specific permissions in the device settings without uninstalling the app.
  • Remove Chronic Offenders: When apps persistently send pings to known tracking and profiling networks without functional justification, removing the application is the most effective way to cut off data transmission entirely.