The 14 data-collection categories
Apple groups collection into 14 categories: Contact Info, Health & Fitness, Financial Info, Location, Sensitive Info, Contacts, User Content, Browsing History, Search History, Identifiers, Purchases, Usage Data, Diagnostics, Other Data. For each you declare three things: (a) is data collected, (b) is it linked to identity, (c) is it used for tracking.
App Tracking Transparency (ATT)
iOS 14.5+ requires requestTrackingAuthorization() before reading IDFA or sharing identifiers across apps. ATT sits on top of nutrition labels — you must declare tracking on the label and obtain the runtime permission. Lying on either side is grounds for App Store rejection.
Privacy Manifests (iOS 17+)
Since iOS 17, third-party SDKs must ship a PrivacyInfo.xcprivacy file declaring data collected and "required reasons" for using sensitive APIs (file timestamps, system boot time, disk space, user defaults, active keyboards). Apple now blocks app submissions whose dependencies are missing manifests for the apps on Apple's commonly-used SDK list.