To publish an app on the Apple App Store, you need a paid Apple Developer Program account, a privacy policy linked both in App Store Connect and inside the app, accurate App Privacy labels, permission through App Tracking Transparency before any tracking, in-app account deletion if users can create accounts, an end-user licence agreement and an honest age rating. On top of Apple's rules, data protection laws such as the GDPR apply wherever you distribute the app. Legal and privacy shortcomings are a common reason for rejection, and the App Store Review Guidelines - particularly Section 5 on privacy - keep changing: as of October 2026 they were last updated on 8 June 2026.
This guide covers the main legal obligations that apply when publishing an iOS, iPadOS, or macOS app to the App Store in 2026.
Apple Developer Program enrolment
Before any legal requirements come into play, the app must be submitted through a paid Apple Developer Program account. Individual enrolment costs $99 per year and requires an Apple Account with two-factor authentication. The applicant must be at least 18 years old. Organisations face extra requirements: an official business email address, legal entity status, a D-U-N-S Number, and a live website.
Accepting the Apple Developer Program License Agreement is mandatory. Apple updates it as new APIs and regional rules arrive, such as the Declared Age Range API and terms for app distribution in Japan, so review the current version when you sign in.
A privacy policy is the baseline
Every app on the App Store must have a privacy policy. Apple's Guideline 5.1.1(i) requires a link to it in two places: the App Store Connect metadata field and within the app itself, somewhere easy to find such as a Settings or About screen. That applies even if the app collects no user data, in which case the policy should say so.
The policy must clearly and explicitly cover the following points:
| Requirement | What to disclose |
|---|---|
| Data collected | Every type of data the app gathers, however minimal |
| Collection methods | How data is collected (forms, SDKs, device sensors, APIs) |
| Purpose of use | All purposes - analytics, personalisation, advertising |
| Third-party sharing | Every third party receiving user data, with confirmation they provide equal data protection |
| Consent revocation | How users can withdraw consent for data collection |
| Data deletion | How users can request deletion of their personal data |
Apple will reject the submission if the privacy policy URL is missing, broken, or leads to a placeholder page. The URL must be live and working at review time.
App Privacy labels
Since December 2020, Apple has required developers to complete App Privacy Details in App Store Connect. These generate the privacy "nutrition label" on the app's product page, giving users a snapshot of data practices before downloading.
The label requires disclosure across several dimensions: what data types are collected, whether each type is linked to the user's identity, whether it is used for tracking, and the purpose of collection. Third-party SDKs complicate things. If the app integrates an analytics SDK that collects device identifiers, that collection must appear on the label even if the developer never directly accesses the data.
Data processed only on-device does not need to be declared - but if any derived data leaves the device, it must be disclosed.
App Tracking Transparency and AI data sharing
Apps that track users across other companies' apps or websites must ask permission through App Tracking Transparency before any tracking begins. Apple defines tracking as linking user or device data from your app with data from other companies' apps, websites or offline properties for targeted advertising or advertising measurement, or sharing it with data brokers, according to its User Privacy and Data Use page. Guideline 5.1.1(iv) says apps must not "manipulate, trick, or force" people to consent to unnecessary data access. Apple also bans device fingerprinting under the Developer Program License Agreement.
The guidelines now also cover AI. You must clearly disclose where personal data will be shared with third parties, "including with third-party AI", and obtain explicit permission before doing so.
Account deletion requirement
Any app that supports account creation must also offer account deletion within the app. This has been mandatory since June 2022 and is a common reason for rejection among apps that rely on user accounts.
It mirrors wider law. The GDPR's right to erasure (Article 17) and the CCPA's deletion rights impose similar obligations on businesses handling personal data of people in the EU and California residents respectively.
End-user licence agreement (EULA)
Apple provides a Standard EULA that applies automatically unless the developer uploads a custom version. Whether custom or standard, the EULA must include Apple's minimum terms: acknowledgement that the agreement is between the developer and end user (not Apple), that the developer bears sole responsibility for the app and its content, and that the developer handles product liability, legal and regulatory claims, and intellectual property claims. The developer's name, address, and contact details must appear in the EULA.
In-app purchases and subscriptions
Digital goods sold within the app generally must use Apple's In-App Purchase system, with Apple retaining a commission (30% standard, 15% under the Small Business Program). Specific exceptions exist for "reader" apps, and apps on the US storefront may now include external payment links following a court ruling.
Subscriptions carry strict disclosure requirements. The app must show full pricing, renewal terms, and cancellation instructions before the user commits to payment. Auto-renewable subscriptions must clearly state the price, duration, and automatic renewal. Failure to present this prominently is a common cause of rejection.
Age ratings and US state age laws
Every app must be assigned an age rating based on its content, and Guideline 2.3.6 asks you to answer the age rating questions honestly. Apple's questionnaire covers violence, mature themes, profanity, gambling, and similar categories, and Apple moved every app to its new age rating system, with answers to the updated questions due by 31 January 2026. AI-powered features count: developers must consider how AI assistants or content generation affect the frequency of sensitive content within the app.
Beyond Apple's own ratings, several US states have passed laws that put age verification obligations on app stores and developers. They include Texas (SB 2420), the App Store Accountability Acts in Utah and Louisiana, and California's Digital Age Assurance Act (AB 1043). In general, app stores must sort users into age bands, and developers must use that signal to apply age-related restrictions and get parental consent for minors. Their effective dates fall between 2026 and 2027, and a federal court blocked the Texas law in December 2025 on First Amendment grounds. Check each law's current status before you rely on it: court challenges can change a law's effect after it passes.
Regional data protection rules
Apple's Guideline 5.1 puts responsibility for following the law on the developer. Distributing an app worldwide can trigger data protection laws in many countries at once.
| Regulation | Jurisdiction | Key obligation for apps |
|---|---|---|
| GDPR | EU and EEA | Lawful basis for processing, consent for tracking, data subject rights |
| UK GDPR | United Kingdom | Close to the EU GDPR, with the ICO as supervisory authority |
| CCPA (as amended by the CPRA) | California | Right to opt out of sale or sharing, privacy notice requirements |
| LGPD | Brazil | 10 legal bases for processing, data subject rights, ANPD oversight |
| PIPEDA | Canada | Consent-based framework, 10 fair information principles |
| POPIA | South Africa | Processing conditions, prior authorisation for special personal information |
An app distributed in the EU that uses analytics, advertising identifiers, or any form of tracking also falls under the ePrivacy Directive alongside the GDPR. On mobile, this usually means the ATT prompt combined with an in-app consent management platform, plus a cookie banner for any web views or hybrid components that load web pages.
Technical build requirements
Since 28 April 2026, apps uploaded to App Store Connect must be built with Xcode 26 or later using the iOS 26 or iPadOS 26 SDK, and since 9 September 2026 iOS and iPadOS apps must target iOS 13 or later, according to Apple's upcoming requirements page. The app must be fully functional at submission - no placeholder content, broken links, or incomplete features. If the app requires login, provide a demo account to the review team. Apple says it typically reviews at least 50% of submissions in less than 24 hours and 90% in less than 48 hours, but rejections for privacy issues can delay launch by days or weeks through Resolution Center exchanges.
Questions about App Store legal requirements
Does an iOS app need a privacy policy even if it collects no user data?
Yes. Apple requires every app on the App Store to include a privacy policy, regardless of whether it collects data. If the app truly gathers nothing, the policy should state that explicitly.
What happens if the privacy policy URL is broken when Apple reviews the app?
The submission will be rejected. Apple checks that all URLs - including the privacy policy and support page - are live and working at review time. Fix the link and resubmit.
Do the new US age verification laws apply to apps not aimed at children?
Generally yes, where they are in effect: the laws in Utah and Louisiana and California's Digital Age Assurance Act apply to apps made available in those states, not only apps directed at minors. Texas's law was blocked by a federal court in December 2025. Check each law's current status and be ready to handle age signals from Apple's APIs.
Can developers use their own payment system instead of Apple's In-App Purchase?
For digital goods and services, Apple's In-App Purchase is generally required. However, reader apps (magazines, books, audio, video) have exceptions, and apps on the US storefront may now include links to alternative payment methods following a court ruling.
When is a custom EULA needed instead of Apple's Standard EULA?
Apple's Standard EULA covers the basics and applies automatically. A custom EULA is only needed if the app has specific terms around subscriptions, content licensing, user-generated content, or service levels that go beyond the standard agreement.
How does the GDPR apply to an iOS app distributed in the EU?
The app needs a lawful basis for every type of data processing, consent before tracking (through an in-app consent mechanism as well as ATT), a way for people to exercise their rights (access, deletion, portability), and consent under the ePrivacy Directive for any cookie or local storage use in web views.
What are Apple's disclosure rules for apps that use AI features?
Apple's guidelines require you to clearly disclose where personal data will be shared with third parties, including third-party AI, and to obtain explicit permission first. The age rating must also account for sensitive content that AI features might produce.
Start with the web views and pages behind your app
Getting the legal side right begins with understanding what data the app collects, and what third-party code collects on its behalf. If your app loads web pages, a cookie scan of those URLs shows the cookies and trackers they set. Kukie.io scans websites, not app binaries, and for those pages it shows a consent banner that follows each visitor's region, with opt-in in the EU and opt-out where that is the rule.
