What Is App Privacy Report on iPhone
Apple introduced App Privacy Report in iOS 15.2 in December 2021. The feature runs on any iPhone or iPad with iOS/iPadOS 15.2 or later, including the current iOS 26. The idea is straightforward: iOS quietly keeps a log of what apps are doing — and on request, shows you that log.
Before the report existed, the only visible signal of app activity was the orange or green dot in the status bar — microphone or camera in use. Now you can see the full picture: exactly when and how often each app accessed a sensor over the last seven days, and which remote domains it contacted.
The observation window is exactly 7 days. Data accumulates gradually: if you just enabled the report, it will be empty or near-empty for the first few hours. One key detail: all information is stored exclusively on your device in encrypted form — Apple does not receive this data and cannot access it.
Why does this matter? Apps frequently access sensors and external domains even when you are not actively using them. Analytics SDKs, advertising libraries, push notification systems — all of these operate in the background. The report makes hidden activity visible, letting you make informed decisions: keep the app, restrict its permissions, or delete it.
How to Enable App Privacy Report (and Why It Starts Empty)
The path in iOS: Settings → Privacy & Security → App Privacy Report → Turn On App Privacy Report. Once you tap the button, the feature begins collecting data from zero.
"From zero" is the key point. The report does not reconstruct past activity. If you enable it right now, for the first few hours you will only see activity that happened after enabling. The full seven-day picture will appear after about a week of normal phone use.
What you need:
- iPhone or iPad running iOS/iPadOS 15.2 or later.
- The feature must be turned on (it is off by default — Apple does not enable data collection without explicit user consent).
- Normal phone use: calls, messaging apps, social media, banking apps — all of this will leave traces in the report.
Once the report has filled up, return to Settings → Privacy & Security → App Privacy Report. Scroll down and you will see four sections.
Four Sections of the Report: What Each One Shows
The report is structured as four independent views of app activity. Understanding what each section actually represents is essential — otherwise it is easy to mistake normal behavior for something suspicious.
Data & Sensor Access
The first section shows which hardware resources and personal data apps accessed. The list covers precise and approximate location, camera, microphone, contacts, photo library, media library, and screen recording.
For each app, the report shows how often and when it requested each resource. It is perfectly normal for Maps to access location when you open it. What should raise a flag is microphone access from an app that is neither a messaging app nor a voice recorder — especially if it happened while you were not using the app. Our guide on dangerous app permissions covers which permissions to prioritize reviewing.
App Network Activity
The second section shows the app's own network requests — direct calls from the app's code to external servers: the developer's API, analytics services, advertising platforms. This is where you see what the app is phoning home to behind the scenes.
Even a simple flashlight app may appear here with several domains — because an analytics SDK or advertising module is bundled inside it. This section is useful for spotting unexpected activity: if an app is hitting an unfamiliar domain every hour, that is worth investigating.
Website Network Activity
The third section is similar to the second, but covers embedded web content: ad banners, embedded video players, WebView screens inside apps. These domains are not called from the app's own code — they come from HTML/JavaScript web pages rendered inside the app.
A typical example is a news app: the app itself may be well-behaved, but the embedded ad networks load scripts from dozens of advertisers and trackers, all of which appear in this section.
Most Contacted Domains
The fourth section is a combined leaderboard. iOS shows the domains contacted most frequently across all your apps over 7 days. This list is the most revealing from a tracking perspective.
You will regularly find advertising and analytics domains here: doubleclick.net, googlesyndication.com, graph.facebook.com, app-measurement.com (Firebase Analytics by Google), AdMob domains, and similar. Their presence is not illegal — developers embed these SDKs legitimately. But the fact remains: these domains collect data about your behavior for advertising networks.
Summary of all four sections:
| Report section | What it shows | What to watch for |
|---|---|---|
| Data & Sensor Access | App accesses to camera, microphone, location, contacts, photos, media library, screen recording | Camera or microphone access from unexpected apps; background activity without obvious reason |
| App Network Activity | Domains the app directly contacts from its own code | Unfamiliar domains; frequent requests to advertising or analytics hosts |
| Website Network Activity | Domains from embedded web content (ads, video players, WebView) inside apps | Many third-party domains in an "innocent" app — a sign of embedded ad networks |
| Most Contacted Domains | Cross-app domain ranking across all apps over 7 days | Ad domains (doubleclick.net, graph.facebook.com, app-measurement.com) at the top of the list |
How to Identify a Tracker in the Domain List
Most Contacted Domains is the most informative and the most opaque list. iOS shows the domain name but does not explain what is behind it. A few pointers to help you make sense of what you see.
Ad networks and DSPs. Domains like doubleclick.net, googlesyndication.com, googletag.com, moatads.com, adnxs.com belong to advertising platforms and audience data collection systems. If they top the list, the apps you have installed include ad SDKs that regularly report user activity.
Analytics platforms. app-measurement.com (Firebase Analytics), analytics.google.com, mixpanel.com, amplitude.com — standard product analytics. Developers use these to understand how users interact with an app: which screens they open, how long they stay, where they drop off.
Social media. graph.facebook.com appears in apps that use the Facebook SDK — even if the app has no relationship with the social network. The SDK may be embedded for Facebook login or for advertising attribution.
The developer's own servers. Requests to a domain clearly linked to the app (such as api.example-app.com) are expected. This is where account data is transmitted, content is synced, and subscriptions are verified.
A practical sign of a suspicious domain: it has no obvious connection to any of your apps, yet ranks high in frequency. That means it is embedded in multiple apps simultaneously as a shared SDK — the standard pattern for cross-app audience trackers.
One note of caution: a high domain count for an app is not automatically a red flag. An email client loading messages with attachments will contact many domains — that is a consequence of diverse incoming mail, not surveillance. Context matters: is this behavior expected for this type of app?
What App Privacy Report Can — and Cannot — Do
App Privacy Report is a mirror, not a shield. Understanding this distinction is important before you interpret the data.
What the report can do:
- Show which apps accessed your camera, microphone, location, and other sensors — and exactly when.
- List the domains each app communicated with.
- Provide a combined domain ranking over 7 days — so you can see who appears across most of your apps at once.
What the report cannot do:
- Break connections to tracker domains.
- Block camera or microphone access — that is handled by permissions in Privacy & Security settings.
- Hide your IP address from the domains apps contact.
- Encrypt DNS queries — these remain visible to your ISP and network intermediaries.
- Show the content of traffic — only the fact of a domain contact and its timing.
This is an architectural limitation: the report works at the OS level as an observer. To block unwanted sensor access, you revoke the permission. To hide your IP and encrypt DNS, you need a network-layer tool.
App Privacy Report and VPN: Separate Layers of Protection
App Privacy Report and a VPN solve different problems, and combining them gives you more complete protection than either alone.
The report answers the question "what is happening": which apps access what, which domains they contact. This is the OS layer — audit and awareness.
A VPN answers the question "how it happens" at the network level: it encrypts DNS queries so your ISP cannot see which domains you are reaching; it hides your real IP address from those domains, which log incoming connections. When your app contacts graph.facebook.com, Facebook sees the VPN server's IP address, not your phone's.
It is important to understand the limits of both tools. A VPN does not prevent an app from contacting a tracker domain — the app will still do so. The contact will still appear in the report. The report, in turn, will not hide your IP or encrypt requests. These tools complement each other; neither replaces the other.
In practice: the report reveals which apps behave unexpectedly → you revoke unnecessary permissions or delete the app → LiMP VPN (Android, Windows and Chrome) encrypts DNS and masks your IP for the remaining network traffic → tracker domains see an anonymous address, not your real one.
To understand how Apple's own privacy tools compare at the network level, see our comparison of iCloud Private Relay vs VPN — it will help you choose the right tool for a specific privacy goal.
Privacy Checklist: Take Control of Your iPhone
- Enable the report now. Settings → Privacy & Security → App Privacy Report → Turn On App Privacy Report.
- Review Data & Sensor Access once a week. Look for microphone or camera access from apps that have no business using those sensors.
- Revoke unnecessary permissions. Settings → Privacy & Security → [sensor] → turn off access for suspicious apps. Our guide on dangerous app permissions explains what to prioritize.
- Disable "Allow Apps to Request to Track" (ATT). Settings → Privacy & Security → Tracking → toggle off. After this, apps cannot request tracking permission and the advertising identifier (IDFA) becomes unavailable. See our full guide on turning off the advertising identifier.
- Review Most Contacted Domains. If advertising and analytics domains appear at the top — from apps you barely use — consider removing those apps.
- Use a VPN on untrusted networks. Public Wi-Fi in cafés, airports, and hotels is an additional risk. LiMP VPN encrypts DNS and traffic, hiding your IP from all parties.
- Periodically audit your installed apps. An app you haven't opened in months but that still appears in the report is a candidate for deletion.
