iOS 15 App Privacy Report Tracking Explained

Apple’s App Privacy Report in iOS 15 provides an on-device audit trail that reveals how frequently applications access sensitive permissions and communicate with external network endpoints. By continuously monitoring outbound network traffic, the feature logs third-party domains, trackers, and analytics services contacted by individual applications across separate usage sessions. This overview details how the underlying operating system captures, attributes, and presents this cross-session tracking telemetry over a rolling seven-day period.

Local Network Traffic Interception

The App Privacy Report functions at the operating system level, sitting between the application and the device's network interfaces. When an app initiates a connection via standard system networking APIs (such as NSURLSession) or low-level sockets, the iOS networking stack intercepts the outbound DNS query and IP routing request.

Because each installed application runs within its own secure sandbox and is assigned a unique system user identifier (UID), iOS attributes every outbound connection directly to the specific app responsible for initiating it. This process operates entirely on the device without routing logs through Apple’s servers.

Domain Resolution and Third-Party Categorization

When an application loads third-party software development kits (SDKs)—such as those provided by advertising networks, social media platforms, or telemetry vendors—these embedded frameworks send requests to external domains.

The App Privacy Report does not inspect the encrypted payload of TLS/HTTPS traffic. Instead, it inspects the Fully Qualified Domain Names (FQDN) resolved during connection handshakes (via Server Name Indication and DNS lookups). When an app makes network requests during a session, the system logs:

  • The Host Domain: The specific address contacted (e.g., analytics.provider.com or graph.facebook.com).
  • Timestamp of Connection: The exact time the network access occurred.
  • App Attribution: The host app bundle that spawned the process.

Session Persistence and Aggregation

App tracking rarely happens during a single usage window; tracking SDKs periodically transmit telemetry during active use, transitions, and authorized background refresh cycles.

To document this ongoing activity, iOS maintains a local database that retains logged events for a rolling seven-day window. Each time an app launches, wakes in the background, or transitions between states, new connection events append to the existing log. The operating system aggregates these events in two distinct views:

  1. App Network Activity: Lists all domains contacted by an individual application across every session within the seven-day period, organized by how many unique domains were accessed and when they were last contacted.
  2. Most Contacted Domains: Aggregates endpoints that are contacted across multiple apps. If multiple applications on the device embed the same tracking or advertising SDK, this view highlights the third-party domain and lists every app that has communicated with it.

Distinguishing First-Party from Third-Party Tracking

While iOS logs all contacted domains indiscriminately under the network activity section, it separates internal app operations from cross-app tracking primarily through visibility. When a user observes the same advertising endpoint appearing under dozens of distinct apps in the "Most Contacted Domains" section, the report makes cross-session, multi-app tracking explicit. Combined with Apple’s App Tracking Transparency (ATT) framework, this data allows users to identify whether apps are adhering to their tracking preferences and which third-party data brokers are actively receiving telemetry from their devices.