# ITMS-91061 Missing privacy manifest in a third-party SDK

> ITMS-91061: your app includes an SDK on Apple's privacy-impacting list that has no privacy manifest. Update the SDK and check the built app.

- Canonical page: https://obelisk.club/blog/itms-91061-missing-privacy-manifest-sdk
- Author: Peter Zhang
- Published: 2026-11-01
- Tags: xcode, app-store-connect, itms, privacy-manifest, debugging

To fix ITMS-91061, update the SDK named in the email to a version that ships its own `PrivacyInfo.xcprivacy` file, confirm the file is inside the built app, and upload a new build. Do not copy the SDK's privacy details into your app's own privacy manifest: Apple says your manifest should describe only your app.

## The exact error

Apple's DTS Engineer quoted the message in an Apple Developer Forums [post about ITMS-91061](https://developer.apple.com/forums/thread/774960):

```text
ITMS-91061: Missing privacy manifest - Your app includes "<path/to/SDK>", which
includes <SDK>, an SDK that was identified in the documentation as a privacy-impacting
third-party SDK. Starting February 12, 2025, if a new app includes a privacy-impacting
SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a privacy
manifest file. Please contact the provider of the SDK that includes this file to get an
updated SDK version with a privacy manifest.
```

The email names the path and the SDK, so you know exactly which dependency to look at. Apple does not publish a list of ITMS codes, so the wording may change.

## Why it happens

Apple keeps a list of commonly used SDKs on its [Third-party SDK requirements](https://developer.apple.com/support/third-party-SDK-requirements/) page. It includes, among others, Alamofire, Kingfisher, Lottie, SDWebImage, SnapKit, RealmSwift, several Firebase and Facebook SDKs, Flutter and a number of Flutter plugins. For those SDKs the page says:

- You must include the privacy manifest for any listed SDK when you submit a new app that includes it, or an app update that adds it.
- Signatures are also required when a listed SDK is used as a binary dependency.
- Any version of a listed SDK, and any SDK that repackages one on the list, is included.

Apple's page [Adding a privacy manifest to your app or third-party SDK](https://developer.apple.com/documentation/bundleresources/adding-a-privacy-manifest-to-your-app-or-third-party-sdk) gives February 12, 2025 as the start date. The usual cause is an old SDK version pinned in your project from before its developer added a manifest.

## How to fix it

These steps follow the DTS post:

1. **Get the SDK name from the email.**
2. **Update to a version that includes a valid privacy manifest.** If none exists, contact the SDK's provider. Bump the version in Swift Package Manager, CocoaPods or wherever the SDK comes from, and check the release notes for a privacy manifest.
3. **Check the manifest is in the expected place** (see below).
4. **Keep your own manifest about your app only.** The DTS post says: "Do not add the privacy practices of the SDK to your app's privacy manifest."
5. **Repeat for every SDK the email lists**, then archive and upload a new build.

Where Apple expects the file:

| Product | Location |
| --- | --- |
| iOS, iPadOS, tvOS, visionOS or watchOS framework | `SampleFramework.framework/PrivacyInfo.xcprivacy` |
| macOS or Mac Catalyst framework | `SampleFramework.framework/Versions/A/Resources/PrivacyInfo.xcprivacy` |
| Swift package | in the target's resources, declared as a resource in the package manifest (Xcode doesn't treat it as one by default) |
| Static library (`.a`) | can't hold resources; Apple says to move it into a static framework and add the manifest there |

If you maintain the SDK yourself, the same Apple page explains how to add the file, and the [privacy manifest generator](/tools/privacy-manifest-generator) builds a valid `PrivacyInfo.xcprivacy` from your choices.

## Check it before you upload

Archive the app, then list every privacy manifest inside the built app:

```bash
find "MyApp.app" -name PrivacyInfo.xcprivacy
```

We ran this on an archived iOS app that uses Firebase and Flutter. It found 21 manifests, some at the root of a framework (`Frameworks/Flutter.framework/PrivacyInfo.xcprivacy`) and some inside resource bundles (`Firebase_FirebaseCore.bundle/PrivacyInfo.xcprivacy`). To see which frameworks have none:

```bash
cd "MyApp.app"
for f in Frameworks/*.framework; do
  [ -n "$(find "$f" -name PrivacyInfo.xcprivacy)" ] && echo "has manifest: $f" || echo "NO manifest:  $f"
done
```

Compare the `NO manifest` lines with Apple's list. Not every framework needs one; the ones that matter for this error are the SDKs on the list and anything that repackages them. Some SDKs keep their manifest in a separate resource bundle rather than inside the framework, so search for the SDK's name before concluding it is missing. `plutil -lint` on each file found confirms it is a readable property list; all 21 in our test returned `OK`.

Your own manifest is a separate check. The [required reason API scanner](/tools/required-reason-api-scanner) looks through your source for APIs that need a declared reason, and the [ITMS-91053 and ITMS-91055 guide](/blog/itms-91053-itms-91055-privacy-manifest) covers the errors those produce. If your email has several codes, paste it into the [ITMS error lookup](/tools/itms-error-lookup).

## FAQ

### Can I fix ITMS-91061 by adding the SDK's details to my app's PrivacyInfo.xcprivacy?

No. Apple's DTS post says your app's manifest should describe only your app's privacy practices, and the SDK must ship its own manifest.

### Which SDKs need a privacy manifest?

The ones on Apple's Third-party SDK requirements page, any version of them, and any SDK that repackages one of them. Apple's documentation also says other SDKs should include one if they use a required reason API, collect data, or contact tracking domains.

### Does an existing app get this error on every update?

The rule in the message covers a new app that includes a listed SDK, or an app update that adds a new one. We have not seen Apple say what happens to an update that keeps an SDK it already had, so treat an old SDK version as a risk and update it anyway.

### The SDK provider has not shipped a manifest. What now?

Apple's post says to contact the provider for an updated version, and not to put the SDK's privacy practices in your app's manifest instead. We found no other route in Apple's documentation, so if no updated version is coming, the remaining choice is to remove or replace that dependency.

### Is ITMS-91061 the same as ITMS-91053?

No. ITMS-91061 is a missing manifest inside a listed SDK. ITMS-91053 is a missing reason for a required reason API, which can come from your code or an SDK's.

## Sources

- [ITMS-91061 post by Apple DTS](https://developer.apple.com/forums/thread/774960), Apple Developer Forums
- [Third-party SDK requirements](https://developer.apple.com/support/third-party-SDK-requirements/), Apple Developer Support
- [Adding a privacy manifest to your app or third-party SDK](https://developer.apple.com/documentation/bundleresources/adding-a-privacy-manifest-to-your-app-or-third-party-sdk), Apple Developer Documentation
- [Privacy manifest files](https://developer.apple.com/documentation/bundleresources/privacy-manifest-files), Apple Developer Documentation