Introduction

This App Store Connect error means your app, or one of its embedded SDKs, uses a protected capability without the required privacy usage description in Info.plist. Apple requires a human-readable reason string for each sensitive permission your app may request.

What a Purpose String Is

A purpose string is the text iOS shows to the user when permission is requested. Without it, the app is missing required privacy metadata and App Store validation can reject the build.

Typical keys include:

• 'NSCameraUsageDescription'
• 'NSMicrophoneUsageDescription'
• 'NSPhotoLibraryUsageDescription'
• 'NSLocationWhenInUseUsageDescription'
• 'NSContactsUsageDescription'

The value should explain why the app needs access in user language, not in engineering language.

Why the Error Happens

The most common reason is obvious: your code now uses camera, microphone, location, photos, or another protected API and the plist key is missing.

The second common reason is less obvious: a third-party SDK references that capability, even if your own app does not call the API directly in an obvious place.

That means the debugging job is:

1. figure out which permission class is involved
2. add the matching plist key
3. make sure the string is meaningful

A Correct Info.plist Example

If your app uses the camera and photo library, the relevant section can look like this:

1<key>NSCameraUsageDescription</key>
2<string>We use the camera so you can scan receipts and upload profile photos.</string>
3
4<key>NSPhotoLibraryUsageDescription</key>
5<string>We use your photo library so you can attach existing images to your account.</string>

The key point is that the strings should describe the actual feature, not a generic statement such as "This app needs access."

Match the Key to the API

You do not add random purpose strings "just in case." The key must match the capability your app or SDK uses.

Examples:

• camera capture needs NSCameraUsageDescription
• microphone recording needs NSMicrophoneUsageDescription
• selecting existing photos often needs a photo library description
• foreground location needs NSLocationWhenInUseUsageDescription

If the wrong key is present, App Store Connect can still reject the app.

Finding the Real Source

If you are not sure what is triggering the requirement, check:

• newly added frameworks
• analytics or ad SDKs
• media pickers
• barcode or document scanning code
• location or Bluetooth features

A useful workflow is to search the project and dependencies for permission-related frameworks or symbols before guessing.

Swift Example That Requires a Purpose String

This simple camera permission request requires the camera description key.

1import AVFoundation
2
3func requestCameraAccess() {
4    AVCaptureDevice.requestAccess(for: .video) { granted in
5        print("Camera granted:", granted)
6    }
7}

If NSCameraUsageDescription is missing, this kind of code will trigger the privacy requirement problem.

Make the Text Review-Friendly

The purpose string is not only for the system dialog. It also helps during review because it shows that the app's requested permission matches a user-visible feature.

Good:

• "We use your location to show nearby pickup points."
• "We use the microphone so you can send voice notes."

Bad:

• "Permission required."
• "Needed for app functionality."

Specific text reduces review friction and improves user trust.

Test on Device, Not Only by Reading the File

After updating Info.plist, run the app on a real device or simulator and trigger the permission flow. Confirm that:

• the dialog appears
• the text is correct
• the feature behaves correctly if access is denied

A valid purpose string alone is not enough if the app crashes or behaves badly after denial.

Libraries Can Surprise You

One tricky case is SDK drift. You add a package for media, ads, or analytics, and the submission suddenly fails with a missing purpose string for a permission your app never explicitly requested before.

In those cases, either:

• add the required string if the SDK truly needs it
• reconfigure the SDK
• remove the dependency if the permission is unnecessary

Do not add unused privacy keys casually, because they imply capabilities your app may not actually need.

Common Pitfalls

• Adding a protected API and forgetting the corresponding Info.plist key.
• Adding a generic message that does not explain the real feature.
• Assuming only your own code matters and ignoring embedded SDKs.
• Using the wrong privacy key for the API being called.
• Fixing the App Store error but not testing the runtime permission flow afterward.

Summary

• A missing purpose string means a protected capability lacks the required Info.plist privacy description.
• The fix is to identify the exact permission class and add the matching key.
• Use clear, user-facing explanation text rather than vague placeholders.
• Third-party SDKs can trigger these requirements too.
• Always test the permission request flow after updating the plist.