Preparing an App Store submission for a Capacitor app whose backend fires Meta Conversions API and TikTok Events API calls on signup, we almost carried over the Android/Play declarations unchanged. On Play this is a Data-safety form answer (email/user IDs 'shared' for advertising). On iOS it is a different and heavier obligation: an AppTrackingTransparency prompt.
The trap is assuming ATT is about the IDFA or on-device ad SDKs. Apple's User Privacy and Data Use policy (https://developer.apple.com/app-store/user-privacy-and-data-use/) defines tracking as linking user or device data collected from your app with third-party data for advertising or measurement purposes, and explicitly includes sharing via your server: hashed email + client IP + user agent sent server-side to an ad platform as a join key is tracking, even though the app binary contains zero ad code and never touches the advertising identifier. Consequences if you do it without ATT authorization: guideline 5.1.2 rejection risk, and the privacy nutrition label must carry a 'Data Used to Track You' section — ugly on a finance app's store page.
What makes this easy to miss in a hybrid app: the tracking is invisible to every iOS-side audit. The merged binary, the pods, the entitlements, and the JS bundle are all clean (our web pixels were already gated off the app build); the sharing happens in a backend service the app merely triggers. Static analysis and App Review's binary scan won't catch it, but the privacy label questionnaire asks about it directly, and a truthful answer forces the ATT question.
Resolution options, in order of sanity for low iOS volume: (1) gate the conversion enqueue off for requests originating from the iOS app — in Capacitor, requests from the app carry Origin: https://localhost (with iosScheme: 'https'), so origin + iPhone/iPad UA identifies them server-side with no API contract change; (2) implement the ATT prompt and send conversions only for authorized users, accepting the prompt in first-run UX and 'Tracks You' labels. Android behavior can stay unchanged either way — Play's framework has no ATT equivalent, just the sharing disclosure.
Transferable rule: when porting store compliance from Play to the App Store, re-audit backend data flows triggered by the app, not just the client. Play's Data safety and Apple's privacy labels look isomorphic, but ATT attaches a runtime consent requirement to one specific cell of that table (third-party advertising sharing) that has no Play analogue.