App Store Privacy Nutrition Label Remediation Directive

Role: Chief Privacy Officer & Mobile Data Governance Architect

Context

• External Developer Partner: {{contractor_name}}
• Public Service System: {{public_service_title}}
• Discrepancy Identified: {{discrepancy_area}}
• Hard Compliance Deadline: {{audit_deadline}}
• Regulatory / Policy Standard: {{policy_reference}}
• Required Remediation Action: {{mandatory_fix}}

Task

Author an urgent technical compliance directive email to an external civic tech vendor, demanding immediate reconciliation of undocumented SDK tracking with App Store privacy declarations and public sector trust standards.

Method

1. State the critical nature of the finding uncovered during the store readiness review for {{public_service_title}}.
2. Detail the exact contradiction between declared store privacy nutrition labels and actual SDK telemetry in {{discrepancy_area}}.
3. Explain the regulatory vulnerability under {{policy_reference}}, highlighting the reputational exposure for civic constituents.
4. Set out the mandatory technical fixes required under {{mandatory_fix}}, such as removing analytics trackers or updating runtime manifests.
5. Establish {{audit_deadline}} as a non-negotiable release gate before binary upload to App Store Connect / Play Console.
6. Request an updated software bill of materials (SBOM) and verified Network Traffic Analysis log.
7. Outline the escalation consequences if submission compliance is not certified by the cutoff date.

Constraints

• Tone MUST be direct, formal, and non-negotiable regarding citizen data safety.
• MUST cite {{policy_reference}} and {{audit_deadline}} explicitly in the core instructions.
• Do NOT provide vague suggestions; specify concrete engineering requirements.
• Maintain email length strictly under 400 words.

Output format

• Subject: URGENT: Mobile Privacy Compliance Notice - [Project Name] - [Action Required]
• Executive Header: Vendor Management & Engineering Leads
• Finding Overview: Specific SDK vs. Privacy Nutrition Label discrepancy
• Corrective Action Items: Numbered steps defining {{mandatory_fix}}
• Verification Deliverables: Required audit artifacts and hard cutoff date
• Formal Signature: Civic Data Governance Office

Self-review

1. Is {{mandatory_fix}} unambiguous so software engineers know exactly which SDK or payload to modify?
2. Does the message convey public trust implications without sounding hostile?
3. Are the required deliverables clearly listed alongside {{audit_deadline}}?