日前蘋果已經官宣，將于北京時間 4 月 21 日以在線形式舉行今年的春季新品發(fā)布會戏溺。那么意味著新的系統(tǒng) iOS 14.5 正式版也會到來渣蜗，因為 iOS 14.5 系統(tǒng)蘋果明確了在此系統(tǒng)上線后將會采用新的 IDFA 政策，沒有正面擁抱變化的我們旷祸，理所應當在最近的一次提審中因為用戶隱私數(shù)據(jù)的問題被拒了耕拷。
下面便是郵件的內容：
Guideline 5.1.2 - Legal - Privacy - Data Use and Sharing
We found in our review that your app collects user and device information to create a unique identifier for the user's device. Apps that fingerprint the user's device in this way are in violation of the Apple Developer Program License Agreement and are not appropriate for the App Store.
Specifically, your app uses algorithmically converted device and usage data to create a unique identifier in order to track the user. The device information collected by your app may include some of the following: kCLLocationAccuracyBest, getifaddrs, NSTimeZone, serviceSubscriberCellularProviders, and NSFileSystemSize.
Per section 3.3.9 of the Apple Developer Program License Agreement, neither you nor your app can use any permanent, device-based identifier, or any data derived therefrom, for purposes of uniquely identifying a device.
Next Steps
To resolve this issue, remove any functionality from your app that uses algorithmically converted device and usage data to create a unique identifier for the user's device. You should also remove any related code or implemented SDKs that support this functionality.
Please note that attempting to hide or obfuscate code designed to fingerprint the user's device, or otherwise evade the review process, may result in the termination of your Apple Developer Program account. Review the Terms & Conditions of the Apple Developer Program to learn more about our policies regarding termination.
Resources
Learn more about our requirements for apps that track users.
其中有提到說違反了開發(fā)者協(xié)議中的第 3.3.9 條款，下面是第 3.3.9 條款的內容：
3.3.9 You and Your Applications (and any third party with whom You have contracted to serve advertising)
may not collect user or device data without prior user consent, whether such data is obtained directly from
the user or through the use of the Apple Software, Apple Services, or Apple SDKs, and then only to provide
a service or function that is directly relevant to the use of the Application, or to serve advertising in
accordance with Sections 3.3.12. You may not broaden or otherwise change the scope of usage for
previously collected user or device data without obtaining prior user consent for such expanded or otherwise
changed data collection. You may not use analytics software in Your Application to collect and send device
data to a third party. Further, neither You nor Your Application will use any permanent, device-based
identifier, or any data derived therefrom, for purposes of uniquely identifying a device.
大概的意思其實就是說我們在沒有經過用戶同意的情況下就收集用戶的設備信息作為唯一標識來提供廣告服務托享。
我們猜測這可能是由兩種情況導致的：
- 蘋果機器審核掃描到我們使用了相關的 IDFA 的 API 卻未使用 IDFA 權限申請彈窗以告知用戶我們需要使用訪問 IDFA 數(shù)據(jù)骚烧；
- 三方 SDK 接入了 CAID 浸赫，雖然中國廣告協(xié)會表示 CAID 解決方案并不會違反蘋果隱私管理政策，但是蘋果對于 CAID 方案的態(tài)度是明令禁止的赃绊；
隨后我們立刻采取了相應的應對措施：
- 排查項目中代碼既峡，刪除被拒郵件中提到的
kCLLocationAccuracyBest、getifaddrs碧查、NSTimeZone运敢、serviceSubscriberCellularProviders和NSFileSystemSize關鍵字相關代碼（只刪除項目中不必要的方法類庫，必要的代碼還是暫時先保留）忠售； - 首次啟動的隱私彈窗中添加上 IDFA 數(shù)據(jù)收集的相關描述传惠，文言大致如下；
感謝您選擇****稻扬！
我們非常重視個人信息包保護卦方，請您閱讀并同意《用戶協(xié)議》和《隱私政策》內所有的條款及內容。如同意以上協(xié)議泰佳，請點擊同意盼砍。
首次安裝時，我們將向您詢問是否授權：
1逝她、設備標識信息（IDFA）：用于統(tǒng)計和內容服務浇坐；
2、定位：用于為您提供精準的定位信息服務汽绢；
3吗跋、通知：方便我們及時并準確提供資訊信息。
- 聯(lián)系三方 SDK 合作商宁昭，詢問近期是否有相關應對方案的更新版本跌宛，并將 SDK 更新到最新能夠過審的版本，特別是通過代碼掃描發(fā)現(xiàn)包含 CAID 的 SDK积仗；
審核結果：
順利通過審核（其實還是應該提前擁抱變化疆拘，盡量提前做一些適配蘋果新審核政策和新系統(tǒng)的方案）；
參考文章：
新一輪的應用商店拒絕潮表明iOS 14.5寂曹、新iPad可能即將面世
關于第三方潛在SDK導致的5.1.2Data use sharing
全面解讀 iOS 14 ATT和SKAdNetwork
為 AppTrackingTransparency 做好準備
蘋果或禁用CAID哎迄，中國科技巨頭挑戰(zhàn)蘋果隱私新規(guī)宣告失敗隆圆？
