Apple requires a privacy policy for apps

In June, Apple announced on its developer forum that the App Store Review Guidelines were updated to require developers to have a link to a privacy policy, which outlines what they will be doing with their users’ data for all new apps and app updates, as part of the app review process. Many of our clients develop apps, so will need to know what to do regarding their privacy policy for apps.

Outline of data and privacy requirements on the Apple App Store

App Store Connect will require a privacy policy for all new apps and app updates before they can be submitted for distribution on the App Store or through TestFlight external testing, from 3 October 2018. This does not give developers much time to get their affairs in order and it is advised that if they are unsure as to the requirements relating to privacy policies or data protection, that they seek legal advice as soon as possible to ensure they are fully prepared for any Apple privacy policy issues which may arise. For specific advice relevant to your particular business, contact our specialist data protection lawyers and we will be happy to help.

The GDPR and privacy policies – why do they matter?

The recent announcement by Apple to insist on a link to a privacy policy for all new apps and app updates is against the background of a global shift in the protection of privacy. In May 2018, the GDPR privacy legislation was introduced, giving users or ‘data subjects’ much greater say over what is done with their data.

This is a global phenomenon though, after a year when customer privacy issues landed Facebook in controversy when Cambridge Analytica were accused of using a Facebook app to use personal data of individuals who were simply connected to those with that app and did not even have the app or give consent for their data to be used in that way. California has also passed similar privacy legislation that will take effect in 2020 and so it is advisable to stay up to date with changes relating to privacy and to take the right advice early on to get this right for your business instead of this costing you dearly in the future.

Do you need a privacy policy?

You may be required by law to have a privacy policy, or by Apple themselves.

• Are you required by law to have a privacy policy?
  You are required by law to have a privacy policy if you are collecting, storing or sharing personal data like an individual’s email address, names or sensitive data like payment information or using a third party service that accesses that information. As well as a legal requirement when using a third party service, your service provider (for example, Google Analytics) may also require you to post a privacy policy. Apps that collect personal data for a legitimate interest without the consent of a user by relying on another legal reason for processing under the GDPR or similar legislation must comply with all terms of that law.

• Are you required to have a privacy policy to comply with Apple’s App Store?
  The introduction of the requirement for a privacy policy and a link to that policy, which can only be edited with a new version of an app, will affect even those under testing. The fact that Apple will only allow a link to a privacy policy to be changed with a software update, makes it likely Apple will check privacy policies comply, before authorising an app. Whilst a privacy policy cannot be altered until the developer submits a new version of an app, if developers add a link to an external website it may still be possible to change the webpage after approval of the app and so this may need to be reviewed by Apple in future. You can find out if your app is affected and how to best comply under 5.1 of the App Store Review Guidelines.Apple makes clear that any app which promotes any form of illegality will be rejected and that you will need to meet any legal requirements of any geographical area you make an app available in, Apple recommends that you consult a lawyer if you are unsure. To ensure that customers understand how their data will be used, you must provide a link in the Privacy Policy URL field in iTunes if a privacy policy is required by law in your country or if your app is to be sold or distributed on the App Store.

Are there different privacy policy requirements and considerations for different types of app?

Apple has been clear in its App Store Review Guidelines that there are additional rules on privacy which will need to be complied with. dependent upon what the app does and the type of data being collected:

• Accesses user or device/usage data: in this case prior consent must be gained for the collection of this data (data including calendar, location and contacts) and paid functionality cannot be withheld if a user does not consent.
• Offers an account registration process or accesses a user’s existing account: such as food shopping with a supermarket online, where you will need to insert personal data such as name address and payment details to register.
• Contains auto-renewable subscriptions or free subscriptions: will have additional considerations relating to consent of users to retain personal data.
• Uses the HomeKit or HealthKit Framework apps that utilise ARKit, Camera APIs, Photo APIs, or other software for depth of facial mapping information, as this is personal data which can easily identify an individual.
• Collects and/or processes Health fitness and medical data:
  • Where an App includes health, fitness and medical data, because the data is especially sensitive Apple makes clear that apps must not disclose data to third parties for advertising, marketing or any purpose other than for improving health management or for the reason data was collected, if permission is given by the user whose data it is.
  • Apps must not add false or inaccurate data in any medical research or health management apps, and personal health information cannot be stored in iCloud.
  • Consent must be obtained from the individual (or their parent or guardian if they are a minor) if an app is carrying out health-related research. For the consent to be informed and so valid the individuals should be told about the nature, purpose and length of research, the procedures, risks and benefits for the individual, confidentiality and how their data will be handled or passed on to, a point of contact and how to withdraw consent.
  • Health related research requires prior approval for the app from an independent ethics review board.
• Integrates Apple Pay: Apps using Apple Pay can only share user data acquired via Apple Pay with third parties to facilitate or improve delivery of goods and services.
• Includes keyboard extensions: as there may be additional security considerations here.
• Appears in the ‘Kids Category’:
  • Apple refers to the Children’s Online Privacy Protection Act and the GDPR in particular, and states that regardless of a person’s age some functionality or entertainment must be provided and so birthdate and parent contact information should only be requested where necessary by law.
  • Any app in the children’s (or ‘Kids’) category or any apps which collect, transmit, or have the capability to share personal information of a minor (such as their name, address, email, location, photos, videos, drawings, chat facilities, or other personal data which when joined together can identify an individual) must have a privacy policy and must comply with all applicable children’s privacy statutes. This goes further than the ‘parental gate requirement’.
• Location services: These should only be used in an app when required for the features and services provided for the app to work, and should not be used for emergency services, to control vehicles or other devices (other than small devices such as drones). However, where they are allowed to be used you must clearly explain what any location data will be collected for and gain prior consent before collecting or processing location data.

What should an Apple privacy policy include?

Apple does not insist on specific wording in a privacy policy, but it has published an article called ‘protecting the user’s privacy’. All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app so that it is easily accessible for users. The privacy policy must clearly:

• Identify what data, if any, the app collects, how it collects that data, and all uses of that data.
• Confirm that where user data is shared with any third party such as analytics tools, advertising networks, third party Software Development Kits and any related entities, that they will provide equal protection of user data as stated in the app’s privacy policy and required by Apple’s App Store Review Guidelines so there are limitations on what the app is allowed to do.
• Explain its data retention and deletion policies and describe in an accessible and clear way, how a user can revoke consent and/or request deletion of their data.

If you would like further guidance on privacy policies, you could look at the European Data Protection Board website or contact us for advice.

How do you add or change your Apple privacy policy?

Apple advises that to add or edit your privacy policy for the App Store:

1. Go to My Apps in App Store Connect, and click on your app.
2. Under App Store, click on App Information.
3. In the top right corner, add your privacy policy link for iOS apps or macOS apps, or enter text directly for tvOS apps.
4. Click Save.

To add your privacy policy link to your app for external TestFlight distribution:

1. Go to My Apps in App Store Connect, and click on your app.
2. Under TestFlight, click Test Information.
3. Add your privacy policy link for iOS apps, or enter text directly for tvOS apps.
4. Click Save.

How seriously does Apple take customer privacy and Apps having a compliant privacy policy?

Apple is the world’s most valuable company and has made it clear in recent years that customer privacy issues are a matter it takes seriously. Apple states in its App Store Review Guidelines that ‘protecting user privacy is paramount in the Apple ecosystem’ and 5.1 of those guidelines explicitly state that ‘developers that use their apps to surreptitiously discover passwords or other private data will be removed from the Developer Program’ and ‘Apps that share user data without user consent or otherwise complying with data privacy laws may be removed from sale and may result in your removal from the Apple Developer Program’.

Apple has attempted to best protect user data privacy by drawing fire from law enforcers by planning to allow automatic encryption. This will close a security leak which allows police to access suspects’ iPhones. Apple are putting privacy first here, even to the extent that some argue it compromises national security; that is how seriously Apple takes customer privacy.

It is prudent for Apple to be concerned, as although app developers are ultimately responsible for their users’ data, some responsibility lies with the platform where an app is hosted. Policies of platforms are being questioned and platforms are being held accountable for data misuse linked to apps they host.

Apple has hinted that it is prepared to act against app developers that break its privacy policies and removed ‘Onavo’ from the app store last month, because it collected data on other apps installed on a user’s device.

What else do you need to know about Apple privacy policy issues?

Apple’s App Store Review Guidelines also mention permission and data use and sharing in 5.1, many of which are requirements under the GDPR, particularly in terms of gaining prior consent from users before collecting their data, clearly setting out how any user data will be used and how a user can easily withdraw consent, but also setting out the following:

• Data minimisation: Only data necessary for the core functionality of an app should be collected and used and should only be used for the purpose it was collected. The out-of-process picker or a share sheet should be used where possible rather than full access to protected resources (for example, photos, contacts, calendar).
• Access: Consent of users must be gained and respected, not overstepped. Users should not be manipulated into giving consent and if consent is not given you might instead consider an alternative (for example, if no consent is given to saving payment details, allow for these to be input manually).
• Signing in to an account: Unless there are a great deal of account-based features allow users to use the app without a log-in. If core app functionality is not linked to a specific social network, you must provide access without a login or via another mechanism. The app must also allow a user to revoke social network credentials and from within the app, block data between the app and social network. An app cannot store credentials or tokens to social networks off of the device and may only use those credentials or tokens to directly connect to the social network from the app, while the app is in use.
• SafariViewController: Where Safari is used within an app, this cannot be used to track users without their consent and the controller must not be hidden.
• Data use and sharing: Unless otherwise permitted by law consent must be gained before collecting, processing or sharing personal data of users. Data can only be used for the purpose it was collected unless consent has been given for the change of purpose or legislation specifically allows for it. Data collected from apps can only be shared with third parties to improve an app or advertising so long as this is compliant, information about what other apps are installed on a user’s device is not permitted for this purpose for your own use or that of a third party. You cannot use information from an individual user’s device (for example, contacts or photos) to build a database of contacts for you or any third party, contact may only be made on this basis after explicit consent by the individual user being contacted
• Anonymity: If data has been collected anonymously it should be kept that way and not joined with other data to allow a user to become identifiable by you or any third party.

Anybody who sells or distributes their apps on the App Store will no doubt see this change as yet another hoop to jump through. Getting an app onto the App Store is already no mean feat, but now anybody selling or distributing apps will need to add a privacy policy to their distributed app (or update their terms) to not only cover GDPR compliance but to reflect Apple's App Store Review Guidelines. This will affect all new releases or updates (even those in testing) from 3 October 2018. The move means that new content will not get released through the App Store if it is not submitted with the right legal documents and older Apps could start being removed if they are not compliant.