What privacy risks can third-party SDKs introduce?

A third-party software development kit, or SDK, adds prebuilt functionality to a website or app. Analytics, advertising, authentication and customer-support features may all rely on SDKs.

The privacy risk depends on what the code can access and what it sends to its provider. An integration may collect identifiers, interaction events or diagnostic information beyond what the developer initially expected.

Review:

• Which information the SDK collects and when collection starts.

• Whether settings disable unnecessary collection.

• Which recipients receive the information.

• How user choices reach the SDK.

• Whether an update changes its behaviour.

Apple’s user privacy and data-use requirements make developers responsible for third-party code included in their apps, including relevant tracking behaviour.

For websites, the same technical review should include scripts loaded through plugins and tag managers. SDK collection belongs within privacy by design, with controls tested against the installed version and actual configuration.