App Store guideline 5.1.2: Data Use and Sharing

What it means

• (i) Unless the law allows otherwise, personal data may not be used, transmitted or handed on without first getting the person's permission. Details of how and where the data will be used must be available. Where personal data goes to third parties, including third-party AI, this must be disclosed clearly and explicit permission obtained first. Data collected from apps may only go to third parties to improve the app or to serve advertising, in line with the Apple Developer Program License Agreement. Tracking a person's activity needs explicit permission through the App Tracking Transparency APIs. An app may not require users to enable system functionality, such as push notifications, location services or tracking, in order to reach functionality or content, use the app, or receive money or other compensation, including gift cards and codes.
• (ii) Data gathered for one purpose cannot be put to another without fresh consent, unless the law explicitly allows it.
• (iii) Apps should not try to build a user profile by stealth from collected data, and may not try to, help with or urge others to unmask anonymous users or rebuild user profiles from data collected through Apple-provided APIs or from data described as anonymized, aggregated or otherwise non-identifiable.
• (iv) What an app learns from Contacts, Photos or other APIs that reach user data may not be used to assemble a contact database for the developer's own use or for sale or distribution to third parties. Apps may not record which other apps sit on a device for the purposes of analytics, advertising or marketing.
• (v) People may not be contacted using details gathered through a user's Contacts or Photos, except on that user's explicit initiative and one person at a time. There is to be no Select All option and no default selection of all contacts. Before sending, the user is to get a clear picture of how the message will look to the recipient, for example what it will say and who will appear as the sender.
• (vi) Data gathered from the HomeKit API, HealthKit, the Clinical Health Records API, the MovementDisorder APIs, ClassKit, or depth or face mapping tools (ARKit, Camera APIs or Photo APIs, for instance) may not feed marketing, advertising or use-based data mining, whether by the developer or by third parties.
• (vii) Apps using Apple Pay may pass user data obtained through Apple Pay to third parties only to enable or improve the delivery of goods and services.

What reviewers look at

The guideline says apps that pass on user data without consent, or otherwise fail to comply with data privacy laws, can be taken off sale and can lead to removal from the Apple Developer Program.

Related guidelines

• Guideline 5.1: Privacy

Apple's text

This page is an unofficial explanation in our own words. Unofficial explanation, not affiliated with Apple. Apple's text prevails. Apple's wording is on its page, linked below.

• Apple's App Review Guidelines, guideline 5.1.2

Want the guidelines grouped by app type?

If we publish the guidelines grouped by what you are building (subscriptions, kids apps, sign-in), we write to you once. We use the email for nothing else.