Privacy Nutrition Labels in the App Store

Privacy is a fundamental human right and is a core value of both Apple and Jamf. We here at Jamf admire much of Apple's work, including its long-standing belief in how important privacy is to the user experience. Similar to Apple, we design our products and services with privacy in mind. As a result, Jamf's privacy philosophy is outlined within our Trust Center and has three principles: compliance, trust and culture. We believe compliance can be achieved and maintained while following privacy laws and regulations. Jamf's approach to privacy focuses on building and maintaining the trust of our customers, partners and employees. Internally, Jamf fosters an organization-wide culture of "privacy by design," ensuring privacy is at the forefront of every feature and product we develop.

We know you rely on Jamf to help your organization succeed with Apple. We also know that you rely on countless apps to do the same. Unfortunately, not every app is as privacy-focused as Jamf. Thankfully, Apple has a resource called Privacy Nutrition Labels to help organizations discover apps that respect user privacy in a way that aligns with their privacy policies.

Privacy Nutrition Labels

In December 2020, Apple rolled out Privacy Nutrition Labels. They require developers to self-declare the data collected by their app as part of their next app update and specify if any collected data is potentially used to track a person across other apps and websites. Apple's introduction of Privacy Nutrition Labels created a whole new world of easily accessible information for privacy-focused users.

The idea behind these labels is to act similarly to nutrition labels on your food's packaging. If you don't care about the details, that's okay. You don't need to read it. But if you do care, having this information in a transparent and easy-to-understand way means you could make informed decisions about what apps you use based on the data they collect.

Label types

Most apps have one or more of three possible labels:

• Data used to track you: specifies the data that may be collected to track you across other apps and websites
• Data linked to you: lists the types of data collected and linked explicitly to you in some form
• Data not linked to you: data that is collected anonymously; most often, it's usage data or diagnostics for app analytics

Apps that do not collect any data show a unique “Data Not Collected” label. Apple does require apps to submit Privacy Nutrition Label information. However, some older apps that have not been updated in a while may show “No Details Provided” as their label. If the developer ever does go to push a new version of the app out, they'll need to provide details of the app's data collection for its Privacy Nutrition Label.

Types of collected data

There are fourteen different types of data that you may see listed within a Privacy Nutrition Label. Remember that not every app will collect all fourteen types, so some may be omitted as applicable. Additional details on how Apple defines types of collected data can be found within its App Store developer guidelines.

• Contact info: Name, email address, phone number, physical address and other user contact information
• Health and fitness: Health, medical, fitness and exercise data
• Financial info: Payment and credit card information and other financial information such salary, income, assets or debts
• Location: Precise or coarse
• Sensitive information: Race, ethnicity, sexual orientation, disabilities, religion and more
• Contacts: Phone numbers, addresses or other information from a user’s contacts
• User content: Emails, text messages, photos, videos, audio data, gameplay content, customer support details and any other user-generated content
• Browsing history: Information collected about the content a user visits while not within the app
• Search history: Information collected about content that a user has viewed while not within the app
• Identifiers: User ID and device ID
• Purchases: Purchase history
• Usage data: Product interactions, advertiser data and other usage data from within the app
• Diagnostics: Crash, performance and other diagnostic data
• Other data: Any other types of collected data that are not covered in the other thirteen

Jamf apps

Let's look at the Privacy Nutrition Labels of Jamf's apps as an example of how apps report the data they collect. Right off the bat, Jamf Unlock, Jamf Setup, Jamf Reset and Self Service don't collect any data whatsoever. Jamf Teacher, Jamf Parent and Jamf School Student collect location, usage data and diagnostics under the Data Note Linked to You label to support the app's intended functionality.

Lastly, there's Jamf Trust. Jamf Trust collects location and contact info under the Data Linked to You label because many of an organization's security-based policies apply based on location and user data. Browsing history, identifiers and diagnostics are also collected under the Data Not Linked to You label. Jamf only collects the minimum amount of data we need to deliver services because protecting your data is paramount to us.

Limited ad tracking

Selecting privacy-focused apps is an excellent step to ensuring that users minimize the personal data they share. To go one step further, you can deploy a configuration profile via Jamf Pro, Jamf School or Jamf Now to enforce limited ad tracking on iOS and iPadOS. By doing so, you are rolling out another tool to help preserve your users' privacy.

Follow these steps to deploy a configuration profile that enforces limited ad tracking:

Jamf Pro

1. Create a new configuration profile for mobile devices
2. Navigate to Restrictions | Functionality.
3. Scroll down to 'Limited ad tracking' and select Enforce

Jamf School

1. Create a new device enrollment configuration profile for iOS.
2. Click Restrictions | Configure.
3. Select Force limited ad tracking and deselect Allow interest-based ads provided by Apple.

Jamf Now

1. Select a Blueprint and select Restrictions.
2. Expand Security & Privacy.
3. Scroll down until you locate Limit Ad Tracking and select it.

Final thoughts

It's important to stress that Privacy Nutrition Labels aren't perfect. While the information provided is helpful, it is self-declared by the app's developer and not audited by Apple. Apple's developer guidelines require that apps submit truthful and honest information, but there's no guarantee it's 100% correct. Apple's Privacy Nutrition Labels are intended to be an additional way for an app to share its privacy practices while supported by a complete privacy policy and app privacy report.

Apple's App Store's Privacy Nutrition Labels are a positive step forward in providing users with the information they need to make informed decisions about their privacy.

As a Jamf admin, we know that you have a lot of considerations to manage. Apple's Privacy Nutrition Labels are an easy and accessible tool to help you determine if an app may meet your organization's privacy policies while limited ad tracking helps ensure your user’s individual privacy.