If you’re launching or updating an iOS app, ensuring your privacy policy complies with both Apple’s App Store Review Guidelines and data protection laws is essential.
Apple requires developers to provide a clear and accessible privacy policy as part of every app submission via App Store Connect, alongside detailed disclosures about how user data is collected and used.
For developers, tech businesses, or startups navigating these obligations under GDPR and the App Store’s requirements, our data protection solicitors can help you create robust, compliant privacy policies that protect your users and your business. Whether you’re working with third-party tools or handling sensitive data such as location, health, or payment information, we can guide you through the legal and regulatory complexity so you can launch with confidence.
Here we'll be explaining:
- Outline of data and privacy requirements on the Apple App Store
- The GDPR and privacy policies – why do they matter?
- Do you need a privacy policy?
- Are there different privacy policy requirements and considerations for different types of app?
- What should an Apple privacy policy include?
- How seriously does Apple take customer privacy and the compliance of apps with its privacy policy?
- What else do you need to know about Apple's privacy policy issues?
- How can you protect your app and stay compliant?
Outline of data and privacy requirements on the Apple App Store
App Store Connect requires a privacy policy for all new apps and app updates before they can be submitted for distribution on the App Store or through TestFlight external testing. Developers unsure of the requirements related to privacy policies or data protection should seek legal advice as soon as possible to ensure full compliance.
The GDPR and privacy policies – why do they matter?
Data protection laws give users or 'data subjects' a much greater say over what is done with their data. Essentially, if you are processing someone's data, then they have a right to know why, what you are doing with it, and with whom you share it.
Do you need a privacy policy?
You may be required by data protection law to have a privacy policy in place, or by Apple itself, so it is helpful to understand what a privacy policy is and what it should include.
- Are you required by law to have a privacy policy?
You are required by law to have a privacy policy if you are collecting, storing or sharing personal data like an individual’s email address, names or sensitive data like payment information or using a third-party service that accesses that information. As well as a legal requirement when using a third-party service, your service provider (for example, Google Analytics) may also require you to post a privacy policy. Apps that collect personal data for a legitimate interest without the consent of a user by relying on another legal reason for processing under the GDPR or similar legislation must comply with all terms of that law.
- Are you required to have a privacy policy to comply with Apple’s App Store?
The fact that Apple will only allow a link to a privacy policy to be changed with a software update makes it likely that Apple will check whether your privacy policies are compliant before authorising an app. While a privacy policy cannot be altered until the developer submits a new version of an app, if developers add a link to an external website, it may still be possible to change the webpage after approval of the app. Thus, this could potentially be reviewed by Apple in the future. You can determine if your app is affected and learn how to best comply with Section 5.1, specifically Privacy, of the App Store Review Guidelines. Apple makes clear that any app which promotes any form of illegality will be rejected and that you will need to meet any legal requirements of any geographical area you make an app available in. To ensure that customers understand how their data will be used, you must provide a link in the Privacy Policy URL field in iTunes if a privacy policy is required by law in your country, or if your app is to be sold or distributed on the App Store.
Are there different privacy policy requirements and considerations for different types of app?
Apple has been clear in its App Store Review Guidelines that there are additional privacy rules that must be complied with. dependent upon what the app does and the type of data being collected:
- Accesses user or device/usage data: In this case, prior consent must be obtained for the collection of this data (including calendar, location, and contacts), and paid functionality cannot be withheld if a user does not consent.
- Offers an account registration process or accesses a user’s existing account, such as food shopping with a supermarket online, where you will need to insert personal data such as name, address and payment details to register.
- Contains auto-renewable subscriptions or free subscriptions: will have additional considerations relating to the consent of users to retain personal data.
- Uses the HomeKit or HealthKit Framework apps that utilise ARKit, Camera APIs, Photo APIs, or other software for depth of facial mapping information, as this is personal data which can easily identify an individual.
- Collects and/or processes health, fitness, and medical data:
- Where an App includes health, fitness and medical data, because the data is especially sensitive Apple makes clear that apps must not disclose data to third parties for advertising, marketing or any purpose other than for improving health management or for the reason data was collected, if permission is given by the user whose data it is.
- Apps must not add false or inaccurate data in any medical research or health management apps, and personal health information cannot be stored in iCloud.
- Consent must be obtained from the individual (or their parent or guardian if they are a minor) if an app is carrying out health-related research. For consent to be informed and valid, individuals should be informed about the nature, purpose, and length of the study, the procedures, risks, and benefits to them, confidentiality, and how their data will be handled or passed on to a point of contact, as well as how to withdraw their consent.
- Health-related research requires prior approval for the app from an independent ethics review board.
- Integrates Apple Pay: Apps using Apple Pay can only share user data acquired via Apple Pay with third parties to facilitate or improve the delivery of goods and services.
- Includes keyboard extensions, as there may be additional security considerations here.
- Appears in the ‘Kids Category’:
- Apple refers to the Children’s Online Privacy Protection Act (COPPA) and the GDPR in particular, and states that regardless of a person’s age, some functionality or entertainment must be provided, and so birthdate and parent contact information should only be requested where necessary by law.
- Any app in the children’s (or ‘Kids’) category or any apps which collect, transmit, or have the capability to share personal information of a minor (such as their name, address, email, location, photos, videos, drawings, chat facilities, or other personal data which when joined together can identify an individual) must have a privacy policy and must comply with all applicable children’s privacy statutes. This goes further than the ‘parental gate requirement’.
- It's worth noting that the ICO's children's code provides a set of standards on how the UK GDPR would apply to children using online services.
- Location services: These should only be used in an app when required for the features and services provided for the app to function, and should not be used for emergency services, to control vehicles, or other devices (except for small devices, such as drones). However, where they are allowed to be used, you must clearly explain what any location data will be collected for and gain prior consent before collecting or processing location data.
For specific advice relevant to your particular business, contact our specialist data protection lawyers, and we will be happy to help.
What should an Apple privacy policy include?
Apple does not insist on specific wording in a privacy policy, but it has published an article called ‘protecting the user’s privacy’. All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app so that it is easily accessible for users. The privacy policy must clearly:
- Identify what data, if any, the app collects, how it collects that data, and all uses of that data.
- Confirm that where user data is shared with any third party, such as analytics tools, advertising networks, third-party Software Development Kits and any related entities, they will provide equal protection of user data as stated in the app’s privacy policy and required by Apple’s App Store Review Guidelines, so, there are limitations on what the app is allowed to do.
- Explain its data retention and deletion policies and describe in an accessible and clear way, how a user can revoke consent and/or request deletion of their data.
If you would like further guidance on how to draft compliant privacy policies, you can contact our data protection specialist lawyers for advice.
How seriously does Apple take customer privacy and the compliance of apps with its privacy policy?
Apple is the world’s most valuable company and has made it clear in recent years that customer privacy issues are a matter it takes seriously. Apple states in its App Store Review Guidelines that ‘protecting user privacy is paramount in the Apple ecosystem’ and 5.1 of those guidelines explicitly state that ‘developers that use their apps to surreptitiously discover passwords or other private data will be removed from the Developer Program and Apps that share user data without user consent or otherwise complying with data privacy laws may be removed from sale and may result in your removal from the Apple Developer Program’.
Apple has attempted to best protect user data privacy by drawing fire from law enforcers by planning to allow automatic encryption. This will close a security leak which allows police to access suspects’ iPhones. Apple are putting privacy first here, even to the extent that some argue it compromises national security.
It is prudent for Apple to be concerned, as although app developers are ultimately responsible for their users’ data, some responsibility lies with the platform where an app is hosted. Policies of platforms are being questioned, and platforms are being held accountable for data misuse linked to apps they host.
As part of Apple’s ‘App Store Improvements' process, Apple is removing apps that no longer function as intended, don't follow current review guidelines, or are outdated.
What else do you need to know about Apple's privacy policy issues?
Apple’s App Store Review Guidelines also mention permission and data use and sharing in 5.1, many of which are requirements under the GDPR, particularly in terms of gaining prior consent from users before collecting their data, clearly setting out how any user data will be used and how a user can easily withdraw consent, but also setting out the following:
- Data minimisation: Only data necessary for the core functionality of an app should be collected and used, and should only be used for the purpose for which it was collected. The out-of-process picker or a share sheet should be used where possible, rather than full access to protected resources (for example, photos, contacts, calendar).
- Access: Users' consent must be gained and respected, not overstepped. Users should not be manipulated into giving consent. If permission is not given, you may consider an alternative approach (for example, if no consent is given to save payment details, allow these to be input manually).
- Signing in to an account: Unless there are a great deal of account-based features, users can use the app without a login. If core app functionality is not linked to a specific social network, you must provide access without requiring a login or via an alternative mechanism. The app must also allow users to revoke their social network credentials and, from within the app, block data exchange between the app and the social network. An app cannot store credentials or tokens for social networks on the device and may only use those credentials or tokens to directly connect to the social network from the app while it is in use.
- SafariViewController: Where Safari is used within an app, this cannot be used to track users without their consent, and the controller must not be hidden.
- Data use and sharing: Unless otherwise permitted by law, consent must be gained before collecting, processing or sharing personal data of users. Data can only be used for the purpose it was collected unless consent has been given for the change of purpose or legislation specifically allows for it. Data collected from apps can only be shared with third parties to improve an app or for advertising purposes, as long as this is compliant. However, information about other apps installed on a user’s device is not permitted for this purpose, for your use, or the use of a third party. You cannot use information from an individual user’s device (for example, contacts or photos) to build a database of contacts for you or any third party; contact may only be made on this basis after explicit consent by the individual user being contacted.
- Anonymity: If data has been collected anonymously, it should be kept that way and not joined with other data to allow a user to become identifiable by you or any third party.
Anybody who sells or distributes their apps on the App Store will no doubt see this as a hoop to jump through. Getting an app onto the App Store is already no mean feat, but anybody selling or distributing apps will have to add a privacy policy to their distributed app (or update their terms) to not only cover GDPR compliance but to reflect Apple's App Store Review Guidelines. This means that new content will not be released through the App Store if it is not submitted with the correct legal documents, and non-compliant Apps could start being removed.
How can you protect your app and stay compliant?
Navigating Apple’s privacy requirements alongside GDPR and other legal standards can feel daunting, but getting this right is critical to avoid rejection from the App Store or legal scrutiny. Whether you’re building a new product, updating an existing app, or scaling globally, our data protection solicitors can advise you on what your privacy policy should include, how to meet Apple’s expectations, and how to ensure ongoing compliance as your app evolves. Please speak to us today and take the stress out of app compliance.
