In short: App Privacy Report is a built-in iPhone feature introduced in iOS 15.2 that records which apps accessed your sensors (camera, microphone, location) and which domains they contacted over the past 7 days. Enable it at Settings → Privacy & Security → App Privacy Report → Turn On App Privacy Report. The report has four sections: Data & Sensor Access, App Network Activity, Website Network Activity, and Most Contacted Domains. All data is encrypted and stored only on your device — Apple cannot see it. Crucially, the report is a diagnostic tool, not a blocker; LiMP VPN complements it by encrypting your DNS queries and hiding your real IP from tracker domains at the network layer.
What Is App Privacy Report on iPhone
Apple introduced App Privacy Report in iOS 15.2 in December 2021. The feature runs on any iPhone or iPad with iOS/iPadOS 15.2 or later, including the current iOS 26. The idea is straightforward: iOS quietly keeps a log of what apps are doing — and on request, shows you that log.
Before the report existed, the only visible signal of app activity was the orange or green dot in the status bar — microphone or camera in use. Now you can see the full picture: exactly when and how often each app accessed a sensor over the last seven days, and which remote domains it contacted.
The observation window is exactly 7 days. Data accumulates gradually: if you just enabled the report, it will be empty or near-empty for the first few hours. One key detail: all information is stored exclusively on your device in encrypted form — Apple does not receive this data and cannot access it.
Why does this matter? Apps frequently access sensors and external domains even when you are not actively using them. Analytics SDKs, advertising libraries, push notification systems — all of these operate in the background. The report makes hidden activity visible, letting you make informed decisions: keep the app, restrict its permissions, or delete it.
How to Enable App Privacy Report (and Why It Starts Empty)
The path in iOS: Settings → Privacy & Security → App Privacy Report → Turn On App Privacy Report. Once you tap the button, the feature begins collecting data from zero.
"From zero" is the key point. The report does not reconstruct past activity. If you enable it right now, for the first few hours you will only see activity that happened after enabling. The full seven-day picture will appear after about a week of normal phone use.
What you need:
- iPhone or iPad running iOS/iPadOS 15.2 or later.
- The feature must be turned on (it is off by default — Apple does not enable data collection without explicit user consent).
- Normal phone use: calls, messaging apps, social media, banking apps — all of this will leave traces in the report.
Once the report has filled up, return to Settings → Privacy & Security → App Privacy Report. Scroll down and you will see four sections.
Four Sections of the Report: What Each One Shows
The report is structured as four independent views of app activity. Understanding what each section actually represents is essential — otherwise it is easy to mistake normal behavior for something suspicious.
Data & Sensor Access
The first section shows which hardware resources and personal data apps accessed. The list covers precise and approximate location, camera, microphone, contacts, photo library, media library, and screen recording.
For each app, the report shows how often and when it requested each resource. It is perfectly normal for Maps to access location when you open it. What should raise a flag is microphone access from an app that is neither a messaging app nor a voice recorder — especially if it happened while you were not using the app. Our guide on dangerous app permissions covers which permissions to prioritize reviewing.
App Network Activity
The second section shows the app's own network requests — direct calls from the app's code to external servers: the developer's API, analytics services, advertising platforms. This is where you see what the app is phoning home to behind the scenes.
Even a simple flashlight app may appear here with several domains — because an analytics SDK or advertising module is bundled inside it. This section is useful for spotting unexpected activity: if an app is hitting an unfamiliar domain every hour, that is worth investigating.
Website Network Activity
The third section is similar to the second, but covers embedded web content: ad banners, embedded video players, WebView screens inside apps. These domains are not called from the app's own code — they come from HTML/JavaScript web pages rendered inside the app.
A typical example is a news app: the app itself may be well-behaved, but the embedded ad networks load scripts from dozens of advertisers and trackers, all of which appear in this section.
Most Contacted Domains
The fourth section is a combined leaderboard. iOS shows the domains contacted most frequently across all your apps over 7 days. This list is the most revealing from a tracking perspective.
You will regularly find advertising and analytics domains here: doubleclick.net, googlesyndication.com, graph.facebook.com, app-measurement.com (Firebase Analytics by Google), AdMob domains, and similar. Their presence is not illegal — developers embed these SDKs legitimately. But the fact remains: these domains collect data about your behavior for advertising networks.
Summary of all four sections:
| Report section | What it shows | What to watch for |
|---|---|---|
| Data & Sensor Access | App accesses to camera, microphone, location, contacts, photos, media library, screen recording | Camera or microphone access from unexpected apps; background activity without obvious reason |
| App Network Activity | Domains the app directly contacts from its own code | Unfamiliar domains; frequent requests to advertising or analytics hosts |
| Website Network Activity | Domains from embedded web content (ads, video players, WebView) inside apps | Many third-party domains in an "innocent" app — a sign of embedded ad networks |
| Most Contacted Domains | Cross-app domain ranking across all apps over 7 days | Ad domains (doubleclick.net, graph.facebook.com, app-measurement.com) at the top of the list |
How to Identify a Tracker in the Domain List
Most Contacted Domains is the most informative and the most opaque list. iOS shows the domain name but does not explain what is behind it. A few pointers to help you make sense of what you see.
Ad networks and DSPs. Domains like doubleclick.net, googlesyndication.com, googletag.com, moatads.com, adnxs.com belong to advertising platforms and audience data collection systems. If they top the list, the apps you have installed include ad SDKs that regularly report user activity.
Analytics platforms. app-measurement.com (Firebase Analytics), analytics.google.com, mixpanel.com, amplitude.com — standard product analytics. Developers use these to understand how users interact with an app: which screens they open, how long they stay, where they drop off.
Social media. graph.facebook.com appears in apps that use the Facebook SDK — even if the app has no relationship with the social network. The SDK may be embedded for Facebook login or for advertising attribution.
The developer's own servers. Requests to a domain clearly linked to the app (such as api.example-app.com) are expected. This is where account data is transmitted, content is synced, and subscriptions are verified.
A practical sign of a suspicious domain: it has no obvious connection to any of your apps, yet ranks high in frequency. That means it is embedded in multiple apps simultaneously as a shared SDK — the standard pattern for cross-app audience trackers.
One note of caution: a high domain count for an app is not automatically a red flag. An email client loading messages with attachments will contact many domains — that is a consequence of diverse incoming mail, not surveillance. Context matters: is this behavior expected for this type of app?
What App Privacy Report Can — and Cannot — Do
App Privacy Report is a mirror, not a shield. Understanding this distinction is important before you interpret the data.
What the report can do:
- Show which apps accessed your camera, microphone, location, and other sensors — and exactly when.
- List the domains each app communicated with.
- Provide a combined domain ranking over 7 days — so you can see who appears across most of your apps at once.
What the report cannot do:
- Break connections to tracker domains.
- Block camera or microphone access — that is handled by permissions in Privacy & Security settings.
- Hide your IP address from the domains apps contact.
- Encrypt DNS queries — these remain visible to your ISP and network intermediaries.
- Show the content of traffic — only the fact of a domain contact and its timing.
This is an architectural limitation: the report works at the OS level as an observer. To block unwanted sensor access, you revoke the permission. To hide your IP and encrypt DNS, you need a network-layer tool.
App Privacy Report and VPN: Separate Layers of Protection
App Privacy Report and a VPN solve different problems, and combining them gives you more complete protection than either alone.
The report answers the question "what is happening": which apps access what, which domains they contact. This is the OS layer — audit and awareness.
A VPN answers the question "how it happens" at the network level: it encrypts DNS queries so your ISP cannot see which domains you are reaching; it hides your real IP address from those domains, which log incoming connections. When your app contacts graph.facebook.com, Facebook sees the VPN server's IP address, not your phone's.
It is important to understand the limits of both tools. A VPN does not prevent an app from contacting a tracker domain — the app will still do so. The contact will still appear in the report. The report, in turn, will not hide your IP or encrypt requests. These tools complement each other; neither replaces the other.
In practice: the report reveals which apps behave unexpectedly → you revoke unnecessary permissions or delete the app → LiMP VPN on iPhone encrypts DNS and masks your IP for the remaining network traffic → tracker domains see an anonymous address, not your real one.
To understand how Apple's own privacy tools compare at the network level, see our comparison of iCloud Private Relay vs VPN — it will help you choose the right tool for a specific privacy goal.
Privacy Checklist: Take Control of Your iPhone
- Enable the report now. Settings → Privacy & Security → App Privacy Report → Turn On App Privacy Report.
- Review Data & Sensor Access once a week. Look for microphone or camera access from apps that have no business using those sensors.
- Revoke unnecessary permissions. Settings → Privacy & Security → [sensor] → turn off access for suspicious apps. Our guide on dangerous app permissions explains what to prioritize.
- Disable "Allow Apps to Request to Track" (ATT). Settings → Privacy & Security → Tracking → toggle off. After this, apps cannot request tracking permission and the advertising identifier (IDFA) becomes unavailable. See our full guide on turning off the advertising identifier.
- Review Most Contacted Domains. If advertising and analytics domains appear at the top — from apps you barely use — consider removing those apps.
- Use a VPN on untrusted networks. Public Wi-Fi in cafés, airports, and hotels is an additional risk. LiMP VPN encrypts DNS and traffic, hiding your IP from all parties.
- Periodically audit your installed apps. An app you haven't opened in months but that still appears in the report is a candidate for deletion.
Frequently Asked Questions
Does App Privacy Report slow down my iPhone or drain the battery?
No. Data collection is built into iOS system mechanisms — iOS already tracks sensor access for its own internal purposes (such as the orange and green status bar dots). App Privacy Report simply makes that data visible to you. There is no measurable impact on performance or battery life.
Why does an app contact dozens of domains even though I barely use it?
Even a closed app can activate periodically for background tasks: receiving push notifications, refreshing content if background app refresh is enabled, and sending queued analytics events. Built-in SDKs for analytics, advertising, and crash reporting often operate on their own schedule and may transmit data at unexpected times.
Does App Privacy Report block trackers?
No. The report is an observer only: it records and displays facts, but does not break any connections. To actually limit tracking, you need to act — revoke permissions, disable ATT, delete apps, or add network-layer protection.
How is this different from "Allow Apps to Request to Track" (ATT)?
ATT is a consent mechanism: it controls whether an app can request access to the advertising identifier IDFA for cross-app and cross-site tracking. App Privacy Report is a diagnostic tool showing actual app behavior — sensor access, network contacts — regardless of ATT status. Both are useful, but they address different problems.
Does App Privacy Report data go to Apple?
No. According to Apple, all information collected by App Privacy Report is encrypted and stored only on your device. Apple does not receive or have access to this data.
Will a VPN hide my activity from App Privacy Report?
No — and that is correct behavior. App Privacy Report is a local iOS function logging activity at the device level. A VPN operates at the network level, hiding your IP and encrypting DNS from external observers, but the fact that an app contacted a domain still appears in the report.
Why is my App Privacy Report empty?
The feature only starts collecting data after you enable it. If you just turned it on, give it some time and use your phone normally. On some iOS versions the report may also reset after a reboot or system update.