A practitioner's checklist for handling user data the right way — Privacy Manifest, ATT, system pickers, App Store nutrition labels, GDPR/CCPA/COPPA. Synthesized from 12 years of WWDC privacy sessions and Apple's app review guidance.
Five sequential phases. Inventory first — you can't protect what you haven't catalogued. Then adopt system privacy APIs (the ones Apple ships are usually safer than what you'd build), handle data carefully, contain third-party leakage, and finally make compliance disclosure honest and durable.
Filter by impact, effort, risk, or category. Risk = how bad it gets if you skip this item — blocker (App Store rejection or regulator action) → low (best practice but tolerable).
High-impact items that take less than a sprint. Most are configuration changes, manifest entries, or small code edits with disproportionate compliance value.