In order to submit new apps, and app updates, Apple’s App Store Review Guidelines require apps to have a link to their privacy policy. In addition to a privacy policy, App Store Connect also asks a series of app privacy questions on data collection to help inform users about your app’s data practices.
If you need help understanding the types of data that you and/or third party partners collect from your app, our specialist data protection solicitors will be happy to help.
Here we'll be explaining:
- Outline of data and privacy requirements on the Apple App Store
- The GDPR and privacy policies – why do they matter?
- Do you need a privacy policy?
- Are there different privacy policy requirements and considerations for different types of app?
- What should an Apple privacy policy include?
- How seriously does Apple take customer privacy and Apps having a compliant privacy policy?
- What else do you need to know about Apple privacy policy issues?
Outline of data and privacy requirements on the Apple App Store
App Store Connect requires a privacy policy for all new apps and app updates before they can be submitted for distribution on the App Store or through TestFlight external testing. It is advised that if developers are unsure as to the requirements relating to privacy policies or data protection, that they seek legal advice as soon as possible to ensure they are fully compliant.
The GDPR and privacy policies – why do they matter?
The GDPR gives users or 'data subjects' a much greater say over what is done with their data. Essentially, if you are processing someone's data, then they have a right to know why, what you are doing with it, and with whom you share it.
We've created a handy guide to help you better understand what is a privacy policy and what it should include.
Do you need a privacy policy?
You may be required by data protection law to have in place a privacy policy, or by Apple themselves.
- Are you required by law to have a privacy policy?
You are required by law to have a privacy policy if you are collecting, storing or sharing personal data like an individual’s email address, names or sensitive data like payment information or using a third party service that accesses that information. As well as a legal requirement when using a third party service, your service provider (for example, Google Analytics) may also require you to post a privacy policy. Apps that collect personal data for a legitimate interest without the consent of a user by relying on another legal reason for processing under the GDPR or similar legislation must comply with all terms of that law.
- Are you required to have a privacy policy to comply with Apple’s App Store?
The fact that Apple will only allow a link to a privacy policy to be changed with a software update, makes it likely Apple will check whether your privacy policies are compliant, before authorising an app. Whilst a privacy policy cannot be altered until the developer submits a new version of an app, if developers add a link to an external website it may still be possible to change the webpage after approval of the app and so this potentially could be reviewed by Apple in future. You can find out if your app is affected and how to best comply under 5.1, namely Privacy, of the App Store Review Guidelines. Apple makes clear that any app which promotes any form of illegality will be rejected and that you will need to meet any legal requirements of any geographical area you make an app available in.To ensure that customers understand how their data will be used, you must provide a link in the Privacy Policy URL field in iTunes if a privacy policy is required by law in your country and or if your app is to be sold or distributed on the App Store.
Are there different privacy policy requirements and considerations for different types of app?
Apple has been clear in its App Store Review Guidelines that there are additional rules on privacy which will need to be complied with. dependent upon what the app does and the type of data being collected:
- Accesses user or device/usage data: in this case prior consent must be gained for the collection of this data (data including calendar, location and contacts) and paid functionality cannot be withheld if a user does not consent.
- Offers an account registration process or accesses a user’s existing account: such as food shopping with a supermarket online, where you will need to insert personal data such as name address and payment details to register.
- Contains auto-renewable subscriptions or free subscriptions: will have additional considerations relating to consent of users to retain personal data.
- Uses the HomeKit or HealthKit Framework apps hat utilise ARKit, Camera APIs, Photo APIs, or other software for depth of facial mapping information, as this is personal data which can easily identify an individual.
- Collects and/or processes Health fitness and medical data:
- Where an App includes health, fitness and medical data, because the data is especially sensitive Apple makes clear that apps must not disclose data to third parties for advertising, marketing or any purpose other than for improving health management or for the reason data was collected, if permission is given by the user whose data it is.
- Apps must not add false or inaccurate data in any medical research or health management apps, and personal health information cannot be stored in iCloud.
- Consent must be obtained from the individual (or their parent or guardian if they are a minor) if an app is carrying out health-related research. For the consent to be informed and so valid the individuals should be told about the nature, purpose and length of research, the procedures, risks and benefits for the individual, confidentiality and how their data will be handled or passed on to, a point of contact and how to withdraw consent.
- Health related research requires prior approval for the app from an independent ethics review board.
- Integrates Apple Pay: Apps using Apple Pay can only share user data acquired via Apple Pay with third parties to facilitate or improve delivery of goods and services.
- Includes keyboard extensions: as there may be additional security considerations here.
- Appears in the ‘Kids Category’:
- Apple refers to the Children’s Online Privacy Protection Act (COPPA) and the GDPR in particular, and states that regardless of a person’s age some functionality or entertainment must be provided and so birthdate and parent contact information should only be requested where necessary by law.
- Any app in the children’s (or ‘Kids’) category or any apps which collect, transmit, or have the capability to share personal information of a minor (such as their name, address, email, location, photos, videos, drawings, chat facilities, or other personal data which when joined together can identify an individual) must have a privacy policy and must comply with all applicable children’s privacy statutes. This goes further than the ‘parental gate requirement’.
- It's worth noting that the ICO children's code provides a set of standards in how the UK GDPR would apply to children using online services.
- Location services: These should only be used in an app when required for the features and services provided for the app to work, and should not be used for emergency services, to control vehicles or other devices (other than small devices such as drones). However, where they are allowed to be used you must clearly explain what any location data will be collected for and gain prior consent before collecting or processing location data.
For specific advice relevant to your particular business, contact our specialist data protection lawyers and we will be happy to help.
What should an Apple privacy policy include?
Apple does not insist on specific wording in a privacy policy, but it has published an article called ‘protecting the user’s privacy’. All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app so that it is easily accessible for users. The privacy policy must clearly:
- Identify what data, if any, the app collects, how it collects that data, and all uses of that data.
- Confirm that where user data is shared with any third party such as analytics tools, advertising networks, third party Software Development Kits and any related entities, that they will provide equal protection of user data as stated in the app’s privacy policy and required by Apple’s App Store Review Guidelines so there are limitations on what the app is allowed to do.
- Explain its data retention and deletion policies and describe in an accessible and clear way, how a user can revoke consent and/or request deletion of their data.
If you would like further guidance on how to draft compliant privacy policies, you can contact our data protection specialist lawyers for advice.
How seriously does Apple take customer privacy and Apps having a compliant privacy policy?
Apple is the world’s most valuable company and has made it clear in recent years that customer privacy issues are a matter it takes seriously. Apple states in its App Store Review Guidelines that ‘protecting user privacy is paramount in the Apple ecosystem’ and 5.1 of those guidelines explicitly state that ‘developers that use their apps to surreptitiously discover passwords or other private data will be removed from the Developer Program and Apps that share user data without user consent or otherwise complying with data privacy laws may be removed from sale and may result in your removal from the Apple Developer Program’.
Apple has attempted to best protect user data privacy by drawing fire from law enforcers by planning to allow automatic encryption. This will close a security leak which allows police to access suspects’ iPhones. Apple are putting privacy first here, even to the extent that some argue it compromises national security.
It is prudent for Apple to be concerned, as although app developers are ultimately responsible for their users’ data, some responsibility lies with the platform where an app is hosted. Policies of platforms are being questioned and platforms are being held accountable for data misuse linked to apps they host.
As part of Apple’s ‘App Store Improvements process’, Apple is removing apps that no longer function as intended, don't follow current review guidelines, or are outdated.
What else do you need to know about Apple privacy policy issues?
Apple’s App Store Review Guidelines also mention permission and data use and sharing in 5.1, many of which are requirements under the GDPR, particularly in terms of gaining prior consent from users before collecting their data, clearly setting out how any user data will be used and how a user can easily withdraw consent, but also setting out the following:
- Data minimisation: Only data necessary for the core functionality of an app should be collected and used and should only be used for the purpose it was collected. The out-of-process picker or a share sheet should be used where possible rather than full access to protected resources (for example, photos, contacts, calendar).
- Access: Consent of users must be gained and respected, not overstepped. Users should not be manipulated into giving consent and if consent is not given you might instead consider an alternative (for example, if no consent is given to saving payment details, allow for these to be input manually).
- Signing in to an account: Unless there are a great deal of account-based features allow users to use the app without a log-in. If core app functionality is not linked to a specific social network, you must provide access without a login or via another mechanism. The app must also allow a user to revoke social network credentials and from within the app, block data between the app and social network. An app cannot store credentials or tokens to social networks off of the device and may only use those credentials or tokens to directly connect to the social network from the app, while the app is in use.
- SafariViewController: Where Safari is used within an app, this cannot be used to track users without their consent and the controller must not be hidden.
- Data use and sharing: Unless otherwise permitted by law consent must be gained before collecting, processing or sharing personal data of users. Data can only be used for the purpose it was collected unless consent has been given for the change of purpose or legislation specifically allows for it. Data collected from apps can only be shared with third parties to improve an app or advertising so long as this is compliant, information about what other apps are installed on a user’s device is not permitted for this purpose for your own use or that of a third party. You cannot use information from an individual user’s device (for example, contacts or photos) to build a database of contacts for you or any third party, contact may only be made on this basis after explicit consent by the individual user being contacted.
- Anonymity: If data has been collected anonymously it should be kept that way and not joined with other data to allow a user to become identifiable by you or any third party.
Anybody who sells or distributes their apps on the App Store will no doubt see this as a hoop to jump through. Getting an app onto the App Store is already no mean feat, but anybody selling or distributing apps will have to add a privacy policy to their distributed app (or update their terms) to not only cover GDPR compliance but to reflect Apple's App Store Review Guidelines. This means, new content will not get released through the App Store if it is not submitted with the right legal documents and uncompliant Apps could start being removed.
