App Store Connect upload errorITMS-91061: missing privacy manifest for a third-party SDK

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why the upload is flagged, and the fix

1. 01

   An old SDK version has no manifest

   “You must include the privacy manifest for any SDK listed below when you submit new apps in App Store Connect that include those SDKs” Apple Developer, Third-party SDK requirements

   Apple checks new apps, and updates that add a listed SDK, for that SDK’s privacy manifest. Older SDK versions shipped without one. The SDK names in the email tell you which ones to update.

2. 02

   A Flutter or React Native plugin pins the old version

   The list includes Flutter, hermes, Capacitor, Cordova and plugins such as path_provider, shared_preferences_ios, url_launcher and image_picker_ios. A plugin can pin an old native SDK. Upgrade the plugins, then the pods, and check Podfile.lock for the versions you actually ship. If the versions don’t change, run pod deintegrate, delete ios/Pods and ios/Podfile.lock, and run pod install. For React Native, hermes is on the list, so upgrade React Native to a version whose Hermes ships the manifest.

   # Flutter
   flutter pub upgrade   # add --major-versions only if this is not enough
   cd ios && pod repo update && pod update && cd ..
   flutter build ipa
   
   # then check which versions the build uses
   grep -E "FirebaseCore|GoogleUtilities" ios/Podfile.lock

3. 03

   A repackaged copy of a listed SDK

   “Any version of a listed SDK, as well as any SDKs that repackage those on the list, are included in the requirement.” Apple Developer, Third-party SDK requirements

   An SDK that bundles a listed one, such as an analytics kit that ships its own copy of a networking library, counts too. Update the outer SDK, or ask its vendor for a version with the manifest.

4. 04

   A binary SDK isn’t signed

   “Signatures are also required in these cases where the listed SDKs are used as binary dependencies.” Apple Developer, Third-party SDK requirements

   Listed SDKs added as binary frameworks, such as an xcframework you dropped into the project, also need a signature. Get a signed build from the vendor instead of an old download.

5. 05

   A manifest in the app target doesn’t cover the SDK

   Adding PrivacyInfo.xcprivacy to your own app target covers your code, not the SDK. The SDK’s manifest has to be inside the SDK or framework bundle, which is why the fix is a newer SDK version.

6. 06

   Check the report before you upload

   “When you prepare to distribute your app, Xcode will combine the privacy manifests across all the third-party SDKs used by your app into a single, easy-to-use report.” Apple Developer, Third-party SDK requirements

   After you archive, Xcode can generate a privacy report from all the manifests in the app. If a listed SDK is missing from it, that SDK has no manifest in this build.

Checked against the vendor’s docs on November 9, 2026: Apple Developer: Third-party SDK requirements; Apple Developer: Privacy manifest files.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: ITMS-91053 missing API declaration · ITMS-90683 missing purpose string · ITMS-90725 SDK version · ITMS-90062 version must be higher