TL;DR. The App Privacy label — the “nutrition label” on your product page — is a self-reported questionnaire in App Store Connect, not a field pulled from your binary. You can update your answers and click Publish at any time; unlike the keyword field or subtitle, the change reaches the product page without a new build or an App Review cycle. But only Account Holder, Admin, or App Manager can answer the questionnaire — Marketing, which can edit your subtitle and screenshots, cannot touch it. And because the label is self-reported, App Review checks it against what your binary and its third-party SDKs actually do; a mismatch is a rejection under Guideline 5.1.1 or 5.1.2, not just a wording problem.
Most indie developers fill out the App Privacy questionnaire once, at launch, when the SDK list is short and every answer is fresh. Then they ship a dozen versions, add an analytics SDK, swap an ad network, and never open that section of App Store Connect again. The label on the product page is still the one from launch day.
What is the App Store privacy label, and where does it live?
It’s the “nutrition label” shown on every product page: a breakdown of what data the app and its third-party code collect, grouped into Data Used to Track You, Data Linked to You, and Data Not Linked to You. Apps that collect nothing show a distinct Data Not Collected badge instead of the category breakdown.
It lives in App Store Connect under App Privacy, separate from App Information where your title, subtitle, and keyword field sit. It’s answered per app, not per version — there’s no history of “what the label said in v3.2,” just the current published state.
Do privacy label changes require a new app version?
No. Apple’s own documentation is explicit: you may update your privacy answers at any time, and you do not need to submit an app update to change them. You edit the questionnaire, click Publish, and the label on the product page updates directly — no new build, no App Review wait.
That puts it in the same small category as promotional text: a field you can change same-day, in contrast to the keyword field, subtitle, and title, which only reach the product page once a new version clears review and releases. If your app has changed what it collects since launch — a new analytics SDK, a payment processor, an ad network — updating the label doesn’t have to wait for your next feature release.
Who can edit the App Privacy questionnaire in App Store Connect?
Only Account Holder, Admin, or App Manager. That’s narrower than the role set for the rest of your ASO metadata: Marketing can edit the subtitle, keyword field, description, screenshots, and Custom Product Pages, but Apple does not extend Marketing access to the privacy questionnaire itself — only to entering the privacy policy URL.
That’s a real gap if you’ve handed ASO work to a contractor under the Marketing role expecting them to own the whole product page. They can ship a new subtitle and screenshots, but they cannot touch the data-collection answers if an SDK changes — that request has to route to whoever holds Admin or App Manager. Worth checking today if you’ve scoped a contractor to Marketing and assumed privacy was in scope.
Why the label is a real App Review risk, not just copy to fill in
The label is self-reported — Apple doesn’t scan your binary to generate it — but App Review does check it against what the app and its bundled SDKs actually do at runtime, and against your linked privacy policy. A label that’s missing a data type your SDK collects, or still lists tracking your app no longer does, is a mismatch Apple’s guidelines cover directly under Guideline 5.1.1 (data collection and storage) and 5.1.2 (data use and sharing). The consequence isn’t a warning; it’s a rejected submission or, for an existing listing, potential removal.
Third-party SDKs are the most common way this drifts out of sync. You didn’t write the analytics or ad SDK’s data collection code, but the label has to reflect what it does anyway — and SDK vendors change their own data practices independent of your release schedule.
An audit worth doing before your next submission
- Open App Store Connect → App Privacy and read your current published answers against your actual SDK list today, not the one from your last major release.
- Cross-check any tracking-related SDK (ad attribution, cross-app measurement) against whether your app still requests App Tracking Transparency permission. If it doesn’t anymore, the label shouldn’t say it tracks.
- If anything’s changed, update the answers and click Publish — it goes live without a new build, so there’s no reason to bundle it into your next version and forget it in the meantime.
- Confirm whoever owns this in your setup actually holds Account Holder, Admin, or App Manager — not just Marketing, which can’t answer the questionnaire even though it can edit everything else on the page.