Apple says it has notified app developers to remove code that lets them record how a user interacts with their apps without explicit user consent
Apple is telling app developers to remove code that allows them to effectively record how a user interacts with their iPhone apps …
Context & Ripple Effects
This notice lands one day after researchers flagged that some iPhone apps embed Glassbox's analytics SDK to record every tap and swipe without permission — sometimes without masking sensitive fields on screen. It is also the second time Apple has moved against covert capture of user behavior: in 2017 it revoked an entitlement that let Uber record the iPhone screen even in the background.
The pattern matters because Apple polices these gaps through App Review rather than OS-level controls, so each notice quietly rewrites what analytics vendors can ship.
First-order effects
- Developers running Glassbox's session-replay SDK must strip the recording code or risk App Store rejection, immediately breaking their funnel-analytics tooling.
- Glassbox and similar session-replay vendors lose compliant distribution on iOS until their SDKs mask sensitive data and obtain explicit consent by default.
Second-order effects
- Analytics providers are pushed to rebuild SDKs around opt-in capture and automatic masking, shifting compliance cost onto the vendor rather than the app developer.
- Rivals' apps face the same review bar, so any competitor still shipping unmasked replay code becomes an easy enforcement target for Apple.
Third-order effects
- If the sequence holds — location sharing in 2018, session recording here, then the App Tracking Transparency deadline and later disclosure rules for third-party AI data sharing — App Review hardens into a de facto privacy regulator whose case-by-case notices accumulate into binding platform policy.
- Session-replay and behavioral analytics become a governed category inside the App Store economy, with consent flows as a shipping requirement rather than a best practice.
The trend: Apple is progressively closing consent loopholes in its app ecosystem through App Review enforcement, moving from location and screen-recording abuses toward a general rule that no behavioral data leaves an app without explicit permission.