Required-reason APIs: the SDK inventory belongs in the release review

A privacy-manifest task cannot be delegated away simply because the code arrived through an SDK. Apple’s upload requirement explicitly includes listed API use in third-party code, making dependency ownership part of release readiness.

Inspect the assembled application

Our recommended workflow begins with the exact dependency versions in the release candidate. Ask what the SDK does, which listed APIs it uses and how the approved reasons are represented in the delivered application. The relevant evidence concerns the assembled build, not a vendor’s generic assurance that its newest release is compliant.

For growth teams, this is a scheduling dependency. Adding or replacing an attribution, monetisation or analytics package can change the review needed before submission. Give the technical owner enough time to inspect that change before the media plan assumes a new event or onboarding flow is live.

Avoid turning the record into a privacy certification

A declared reason is not proof of every privacy claim a game makes. This change log checks one documented upload control. Data collection, permission choices and business disclosures still require their own evidence and accountable owners.

The accompanying table is intended for release planning: scope, effective date, owner and next verification. Use it to ask a precise question about the candidate build. If the dependency list changes after sign-off, preserve the earlier result and record the new check rather than letting the old approval float across versions.

The governing record is Approved reasons for APIs. This edition checks the provider documentation; it does not inspect a studio account or certify a shipped build.

Inspect the evidence

Download the applicability and deadline record. The extraction separates documented facts from our analysis and unknowns.

Further reading in the existing archive: Privacy by design in UA data flows; The MMP Migration Checklist to Run Before You Switch. These links provide background; this check does not independently verify their full contents.