App Store rejectionGuideline 5.1.2 - Legal - Privacy - Data Use and Sharing

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

The usual causes, and the fix

1. 01

   Tracking without the App Tracking Transparency prompt

   “You must receive explicit permission from users via the App Tracking Transparency APIs to track their activity.” Apple, Guideline 5.1.2(i)

   Linking data from the app with other companies’ data for ads, or sharing the advertising identifier, is tracking, and an ads or attribution SDK can do it even when your own code doesn’t. Ask with requestTrackingAuthorization before it starts, add NSUserTrackingUsageDescription to Info.plist, and make the App Privacy answers in App Store Connect match what the app does. Ask once the app is active on screen: a request made too early at launch can show no prompt.

   import AppTrackingTransparency
   
   ATTrackingManager.requestTrackingAuthorization { status in
     if status == .authorized {
       // start the ads SDK with tracking
     }
   }

2. 02

   Personal data sent to a third-party AI

   “You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so.” Apple, Guideline 5.1.2(i)

   If the app sends what a user types, says or uploads to an outside AI service, tell them where it goes and get explicit permission first. Add a short screen before the first use that names the provider and what is sent, with a way to say no, and update the privacy policy to match.

3. 03

   A feature locked behind tracking, location or notifications

   “Your app may not require users to enable system functionalities (such as push notifications, location services, tracking) in order to access functionality” Apple, Guideline 5.1.2(i)

   A screen that blocks the app until tracking is on, or a reward for allowing notifications, breaks this rule. Ask at the moment a feature needs the permission, and keep the rest of the app working when the answer is no.

4. 04

   Data reused for a new purpose

   “Data collected for one purpose may not be repurposed without further consent unless otherwise explicitly permitted by law.” Apple, Guideline 5.1.2(ii)

   An email address collected for sign-in and later used for marketing, for example, needs new consent under Apple’s rule, unless the law explicitly permits it. Ask again before the new use, and keep a record of who agreed.

Checked against the vendor’s docs on November 9, 2026: Apple: App Review Guidelines, 5.1.2 Data Use and Sharing; Apple: App Review (replying and appeals).

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start

Related: App Store Guideline 5.1.1 · App Store Guideline 2.1 · App Store Guideline 2.5.1 · App Store Guideline 5.2.1