iOS privacy and ATT
How the Layers SDK handles ATT, IDFA, consent, attribution, conversion forwarding, and its bundled privacy manifest.
This page describes the SDK's behavior and controls. It does not prescribe your app's App Store Connect answers: those answers cover your whole app, including the events you send and the destinations you enable.
ATT and Layers consent are separate
Starting in SDK 3.3.0, requesting App Tracking Transparency permission:
- the SDK records the current ATT status;
- it includes the IDFA only when ATT returns
authorized; and - in Swift, Flutter, and Unity, it refreshes the IDFV when that identifier is available.
By default, the ATT result does not call setConsent or change Layers
analytics or advertising consent. A denied, restricted, or not-determined ATT
result leaves the IDFA absent but does not turn off Layers event delivery.
Swift keeps the old attDrivesAdvertisingConsent configuration option for
source compatibility. It is deprecated and defaults to false; setting it to
true preserves the old Swift mirroring behavior. React Native, Expo, Flutter,
and Unity do not map ATT onto Layers consent.
What continues without IDFA
Install attribution, analytics, and configured Conversions API forwarding keep working when IDFA is unavailable. The IDFA is one match signal, not an on/off switch for the pipeline.
The SDK and ingest service continue to use the signals that are available,
including the per-install ID, IDFV, app user ID after identify, deep-link and
campaign click identifiers, event data, and request metadata. For Meta, the
IDFA is sent as madid only when it is present; without it, the payload can
still use fields such as the install or app user ID, click attribution, IP
address, and user agent.
ATT updates merge into the SDK's existing device context. They do not erase the install ID or attribution identifiers already captured for the install.
Explicit Layers consent
With the 3.3.0 defaults, setConsent is the independent control for an app's
consent decision. Layers changes consent only when the app calls that API
explicitly. The deprecated Swift compatibility switch described above is the
only opt-in exception.
- An explicit advertising denial removes IDFA and ATT status from SDK events, adds the applicable ad-user-data and personalization denial signals, and is enforced per destination by server-side conversion forwarding.
- In Swift,
consentRequired: truekeeps its existing opt-in behavior: delivery waits for the app's explicit grant. - An app that does not call
setConsentuses the SDK's normal delivery path; ATT still determines whether IDFA can be included.
Data the SDK can send
By default, events sent to in.layers.com can include persistent per-install
identifiers, the IDFV, the ATT status, the IDFA when authorized, an app user ID
after identify, event names and properties, app/device context, and captured
attribution parameters. Purchase events can include values such as revenue,
currency, product ID, and transaction ID.
Crash and performance behavior differs by wrapper:
| Wrapper | Default behavior |
|---|---|
| Native Swift | Does not attach its exception or MetricKit modules, so it does not collect crash or performance data by default |
| React Native / Expo | Does not auto-collect crash or performance data |
| Flutter | Exception capture is enabled by default and can be disabled with automaticExceptionTrackingEnabled: false |
| Unity | Exception and performance capture are enabled by default and can be disabled with AutoTrackExceptions = false and AutoTrackPerformance = false |
The privacy manifest Layers ships
Starting in SDK 3.3.0, each native package's PrivacyInfo.xcprivacy contains
only the required-reason APIs used by that package:
| Package | Required-reason declarations |
|---|---|
| Swift, Flutter, Unity | User Defaults CA92.1, file timestamps C617.1, system boot time 35F9.1 |
| React Native (including Expo through its React Native dependency) | File timestamps C617.1 |
The SDK manifests do not set NSPrivacyTracking,
NSPrivacyTrackingDomains, or NSPrivacyCollectedDataTypes. They describe the
SDK package's required-reason API use; they are not a substitute for the host
app's App Store Connect submission or an app-level privacy manifest.
Info.plist keys
NSUserTrackingUsageDescription— required before your app requests ATT permission. The Expo plugin and Unity post-build processor can write it from configuration; native Swift, React Native, and Flutter apps add it in their app target.SKAdNetworkItems— add the identifiers required by the ad networks your app uses. Expo and Unity can write their configured lists.NSAdvertisingAttributionReportEndpoint— configure this only when Layers should receive the app's SKAdNetwork postbacks. iOS supports one endpoint per app.
Attribution controls
- Clipboard attribution is off by default and is enabled per app. When used, iOS displays its paste notification.
- The SDK never includes IDFA unless ATT is authorized.
See also
- Attribution — how ATT, clipboard attribution, and Install Referrer feed attribution.
- Installation — per-platform setup, including ATT and SKAdNetwork configuration.
- Data protection — retention and identifier handling at ingest.
- Security & compliance — sub-processors, encryption, and data-subject requests.