Overview

This test identifies whether the app properly declares all known tracking domains it may communicate with in the NSPrivacyTrackingDomains section of its Privacy Manifest files.

To perform this test, use one or more curated lists of known trackers. These lists include domains and identifiers associated with advertising networks, analytics providers, and user profiling services. They are commonly used in privacy-focused tools and browsers to detect and block tracking behavior.

Some example lists:

These references can be used to match hardcoded or dynamically accessed domains within your app and verify whether appropriate declarations exist in the Privacy Manifest.

In terms of APIs, you should consider any networking API that allows the app to communicate with external servers, such as URLSession, NSURLSession, NSURLConnection, or third-party networking libraries (e.g., Alamofire, AFNetworking). Additionally, look for references to well-known tracking libraries (e.g., Facebook SDK, Google Analytics) that may indicate the presence of tracking functionality.

Steps

  1. Use MASTG-TECH-0058 to extract the relevant binaries from app package.
  2. Use MASTG-TECH-0066 to look for the relevant APIs in the app binaries.
  3. Use MASTG-TECH-0071 to search for hardcoded strings representing known tracking domains.
  4. Use MASTG-TECH-0136 to extract the app's privacy manifest files, including those from third-party SDKs or frameworks.
  5. Use MASTG-TECH-0137 to obtain the list of declared tracking domains from the privacy manifest files.
  6. Use MASTG-TECH-0062 to intercept and log all outbound network traffic.

Observation

The output should contain:

Evaluation

The test case fails if any of the following is missing in the privacy manifest files' NSPrivacyTrackingDomains key for the app or any of its components (Frameworks, Plugins, etc.):