Viewing and Categorizing Mobile App Consent Scan Results
You can view the results of your scan as soon as the scan is complete. The Scanner will attempt to categorize the SDKs and Permission for the Application.
To view scan results
Overview tab
The Overview tab shows a detailed overview of your app's scan results. You can use the Show field to select which scan results to view. Use the General widget to see what SDKs were found in your application, the permissions requested by applications, and the data types being collected (Android only). Click the Scan now button to initiate another application scan. Click the Export button to export the selected scan results as an Excel file.
You can leverage the SDKs by category widget to review the Default Category to which each of the detected SDKs belongs, and the App permissions by type widget to view a count of each type of highly risky app permission detected.
iOS scanner
If previous SDK scans do not display, rescan the application using the iOS V2 scanner (released with OneTrust 202508.1.0). Once rescanned, the scan results dashboard becomes visible in the UI.
Privacy Manifest Audit
The Privacy Manifest Audit feature is available for customers with solution packaging only.
The iOS scanner displays a iOS privacy manifest audit section. This section reflects the scanner's validation of declarations of data types in your app's Privacy Manifest file against the Privacy Manifest files in SDK dependencies.
The Privacy Manifest audit helps you review data use of an App’s SDK dependencies and match your own data type declarations to those declarations. The table displays all Data Types recognized by Apple and UNKNOWN for any declared data type that is not.
There are three statuses for a data type:
-
Aligned: the declaration of this data type in your Privacy Manifest matches all declarations of this data type in SDK Privacy Manifests.
-
Mismatched: you declared a Data Type that’s declared by an SDK but some details of the SDK declaration are missing.
-
Missing: a data type is declared in one or more SDKs dependencies and is missing from your own Privacy Manifest.
Click on a Collected data type to review mismatches.
To repair a privacy manifest's data
You can repair any mismatched or missing data types found in your privacy manifest.
Repairing a privacy manifest updates the privacy manifest from the current scan with the same attributes as the detected SDK data type values.
For example, a mismatch is detected because an SDK has User Id > Tracking set to true and the app manifest has it set to false. Once you repair the mismatch, the privacy manifest for the current scan will update User Id > Tracking to true.
- Use the checkboxes to select the data types you want to repair. The Repair button appears.
- Click the Repair button.
Tip:
You can also click the data type name to repair individual attributes within a data type on the data type's Details pane.
If you need to undo your corrections, you can select a previous version of the Privacy Manifest from the version selection menu to restore the previous version and make new corrections. The updated corrections will be saved as a new version.
To export the privacy manifest file
The manifest will export as a .xcprivacy file. For more information, see Apple's documentation on privacy manifest files.
- Click the Export icon
. A notification appears on the Notifications icon in the app header
.
- Click the Notifications icon. The Notifications popover appears.
Android scanner
On the Android scanner, you can also use the Data types being collected list to view what data types and categories are being collected by SDKs. Click the number in the SDK count column to view which SDKs are using a specific data type-data category pair.
SDKs Tab
The SDKs tab displays details on each SDK found in your app scan. In the SDK Summary widget, you can view a count of total SDKs detected and the SDKs by category graph, which displays a count of each category of SDK detected. The SDKs are categorized based on the following categories:
The Search functionality can be used to search by Data Types.
- Strictly Necessary
-
Strictly Necessary means the SDKs are essential for SDK functionality, with minimal data collection.
- Functionality
-
Adds SDK features. They may collect data for internal use to improve user experience.
- Performance
-
Performance SDKs are those that collect usage data for performance optimization, often anonymized.
- Targeting/Advertising
-
These gather detailed user data for ad targeting, often shared with ad networks.
- Social Media
-
Social Media SDKs enable social sharing and integration. They also track interactions for enhanced engagement.
The Android SDKs are also categorized based on methodology developed by Google for the Google Play SDK Index and iOS SDKs by the OneTrust iOS SDK Classification System.
The SDK details list provides an overview of each SDK detected in the selected scan, as well as the data collection status of each SDK. You can click the name of an SDK to view SDK data points as well as review your SDK targets and categorizations. A pane opens on the right side of the screen displaying a list of details: for Android, it includes data category, data type, data point, and source; for iOS, it shows dependencies, categories, and privacy impact. For more information, see Performing SDK Data Type Analysis.
You can search by SDK Name, Vendor, or Default Category.
To learn more about the Android data types that SDKs collect, see the Google Play Data Safety form section on data types and purposes.
Permissions Tab
Mobile app scanners analyze Android app permissions to help uncover potential privacy and security risks. However, traditional reports often present this information in a complex, scattered way, making it hard for users to act on what really matters.
-
The Permissions tab displays the permissions found in your app scan.
-
The Permissions summary widget displays a Total count of all permissions found, as well as a High-Risk count of all dangerous and deprecated permissions.
-
The App permissions by category widget contains a count of the permission groups found, which are graphed by category.
You can use the App permissions details list to view each permission group detected and a count of permissions in each group. In addition, you can search by Name or Category using the Search functionality.
- Accounts
-
Allows the app to access accounts on the device, such as email accounts and social media accounts.
- Calls/SMS/Voicemail
-
Allows an application to read and write the user’s contacts data, initiate a phone call, and allows read only access to phone state.
- Device Details
-
Allows an application to create system alert windows, retrieve list of accounts in the Accounts Service, allows access to device wake lock, battery statistics, calendar, and other device information.
- Device Hardware
-
Allows access to the vibrate function, camera, write access to external storage and recording audio.
- Diagnostics
-
Allows the app to collect diagnostic data from the device, such as system logs and crash reports.
- Location
-
Allows an application to access approximate or precise device location.
- Media
-
Allows apps to access media files on your device, such as audio files, image files, and video files.
- Network
-
Allows an application to change Wi-Fi connectivity state, access information about networks, change network connectivity state and open network sockets.
- Not Classified
-
Permissions that are currently not classified and may be considered a privacy risk.
- System Notifications
-
Allows the app to display system notifications, such as notifications about new messages or app updates.
- Widgets
-
Allows apps to create and manage widgets on your home screen.
Focus on what matters: Dangerous permissions
Instead of overwhelming users with all permissions, the new system prioritizes dangerous (runtime) permissions, those that access sensitive user data like:
-
Location
-
Contacts
-
Camera
-
Microphone
-
Storage
These permissions trigger user confirmation dialogs because they access private or sensitive data, putting them at a higher risk from a privacy and security standpoint. To support better decision-making, OneTrust classifies them with a Dangerous, Highly Sensitive, or Sensitive status, helping users and teams quickly understand their impact on privacy and compliance.
Other features of the dashboard
iOS
Android
View dangerous and deprecated permissions
Quickly see which apps request dangerous or outdated permissions in a clear, centralized interface.
App permission audit report
Export a detailed report of all declared dangerous and deprecated permissions for any app. This helps you with audits and documentation.
Review and share
Simplify collaboration by reviewing and sharing key permission risks across teams or with compliance stakeholders.
To export scan data
- Select one of the following exports:
- Privacy manifest (XLS)
-
(iOS)
Important:The Privacy Manifest Audit feature is available for customers with solution packaging only.
This report includes your privacy manifest audit information for a specific iOS scan, organized by data type.
- Third-Party Data Audit Report
-
(Android)
This report is automatically generated upon completion of the analysis. It supports both .xlsx and .csv export formats, which is useful when reviewing SDKs that collect data before submitting the Android app to Google Play via Play Console for compliance review.
- Permission audit report
-
(Android)
This report is automatically generated when the analysis is completed and supports both .xlsx and .csv export formats, which is easier to use when reviewing dangerous and deprecated Android app permissions prior to submitting to Google Play via Play Console.
- (Legacy) PDF Format
- (Legacy) XLS Format
- Click the Notifications icon
to access your report.
To create a category for SDKs
Create Category Modal Reference
- Field
- Description
- Category Name
-
Enter the name of the category.
- Category Id
-
Enter an identifier for the category.
If you use a tag manager to manage your cookies, the identifier will be used in the rules that you configure to integrate with your banner script.
- Description
-
Enter a description of the category. This description will appear in your preference center when the site visitor is selecting preferences.
- Want to show a different title and description text for Mobile Apps?
-
Enable this setting to enter a separate title and description for mobile specific categories.
- Want to show a different title and description text for CTV Apps?
-
Enable this setting to enter a separate title and description for CTV specific categories.
Reviewing and editing SDKs classifications
The Android and iOS scanner automatically classifies SDKs. There are two workflows when reviewing and editing SDKs:
To categorize SDKs by application (Workflow 1)
-
On the Cookie Consent menu, select Mobile apps. The Mobile apps screen appears.
-
Click the Add mobile app button to upload a new mobile app or select an existing app from the list.
-
Navigate to the Scan results tab then click SDKs.
-
Go to the SDK details section. Click the link in the SDK name column for the SDK you want to edit. A pane on the right side of the screen appears for this SDK.
-
Click Update SDK cookie categories. The SDKs tab opens in Tracking technologies and the SDK Name is shown with the selected Default Category.
-
Click the SDK name. The SDK details screen appears.
-
On the Details tab click any fields you need to edit or navigate to the Categorization tab. Configure the categorization as needed.
Details tab
- Field
- Description
- SDK Name
-
Add the name of the SDK.
- Default Category
-
Select the category of the SDK.
- Platform
-
Select iOS or Android.
- Vendor
-
Add the source of the SDK.
- SDK Description
-
Add a short description of the SDK.
- IAB Vendor Id
-
Select Yes or No.
Categorization tab
- Field
- Description
- Mobile Apps
-
Select the checkbox for the mobile app for which you want to edit the SDK details.
- Categorization
-
Select a categorization from the menu.
- Description
-
Add a description for the mobile app you have selected.
- Export
-
Click the Export button to generate an .xlsx export.
- Manage Mobile Apps
-
Click the Manage Mobile Apps button to search or select them from the Manage Mobile Apps modal.
- Bulk Categorize
-
Click the Bulk Categorize button to categorize SDKs in bulk when two or more SDKs are selected in the Advanced Categorizations table.
The Android & iOS SDK Classification System preserves existing SDK classifications in Tracking Technologies > SDKs and does not overwrite them. Because SDK names may have variations or aliases, the same SDK can appear multiple times with different classifications.
To categorize SDKs using Tracking Technologies (Workflow 2)
-
On the Cookie Consent menu, select Tracking technologies. The Tracking technologies screen appears.
-
Select the SDKs tab. The All Apps list appears.
-
Click the Add SDK button. The Add SDK screen appears.
-
Complete the fields and click the Next button.
-
Select the mobile apps from the list and click the Next button.
-
The Advanced Categorizations screen allows you to edit the SDK details.
-
Click the Create button.
To edit a category for SDKs
To bulk categorize SDKs
You can update the default category of an entire SDK using the Recategorize feature.
Recategorized SDKs do not display on the Overview menu of the Scan results tab when scanning an app with V2 Android and iOS scanners. However, the category that was assigned for this SDK in the Categorizations screen will be used to determine how to handle user consent upon SDK publication.
The SDK category is retained and displays on the Scan results page after recategorization when using V1 Android and iOS scanners.
- Select the SDK(s) you want to re-categorize using the checkboxes to the left of the SDK name(s).
- Click the Recategorize button. The Edit Categories modal appears.
- Click the Assign button to complete the re-categorization process.
Note:
After the SDK has been recategorized, the change is recorded on the Activity tab of the SDK Details screen. The Old Value section has information about the previous categorization and the New Value section has the updated categorization.
To assign an SDK to multiple applications
You can assign one or more SDKs to one or more applications using the Manage Applications feature.
- Select the SDK(s) you want to assign to multiple applications using the checkboxes to the left of the SDK name(s).
- Select the application(s) that the SDK(s) need to be added to.