# App Privacy nutrition labels age rating export compliance and DSA trader status > Source-anchored research for App Privacy nutrition labels age rating export compliance and DSA trader status. Run status: COMPLETED. Parent: [App Review Privacy, AI Consent and Rejection Playbook](https://llms-explorer.com/tree/apple-app-review-privacy-ai-and-rejection-playbook/) · 4 facets · 14 facts · page: https://llms-explorer.com/tree/app-privacy-nutrition-labels-age-rating-export-compliance-and-dsa-trader-status/ ## Definitions - 'Tracking' means linking app data with third-party data for targeted advertising/ad measurement, or sharing with a data broker. An app with no analytics or ads SDKs and no such sharing declares no tracking. (high confidence) — [source](https://developer.apple.com/app-store/app-privacy-details/) - Trader means acting for trade, business, craft or profession (paid apps, IAP, ads, VAT registration, business activity). Traders have address (D-U-N-S auto-filled for organisations), phone and email shown on product pages in all 27 EU territories, and must complete 2FA email/phone verification plus document upload. Non-traders show 'consumer rights ... won't apply'. (high confidence) — [source](https://developer.apple.com/help/app-store-connect/manage-compliance-information/manage-european-union-digital-services-act-compliance-information) ## Structure and components - Disclosure is optional only for data meeting ALL of: not used for tracking, not used for advertising/marketing, collected infrequently and not part of primary functionality and optional, and user-provided with clear consent each time. Optional user-keyed AI calls that are a core feature do not obviously qualify, so default to disclosing the data types sent (e.g. User Content, Diagnostics). (medium confidence) — [source](https://developer.apple.com/app-store/app-privacy-details/) ## How it works - Even with exempt encryption, a year-end self-classification report to US BIS may still be required; it is not needed when non-exempt encryption documentation is provided to Apple. Apple places liability for misclassification on the developer. If the app bundles its own TLS/SMTP crypto library (not OS Network.framework/URLSession), the NO answer needs checking. (medium confidence) — [source](https://developer.apple.com/tutorials/data/documentation/security/complying-with-encryption-export-regulations.md) ## Facts and statements - All apps, including macOS/Mac App Store apps, must provide App Privacy details in App Store Connect for new submissions and updates, plus a URL to a publicly accessible privacy policy. Account Holder, Admin or App Manager enters them. (high confidence) — [source](https://developer.apple.com/app-store/app-privacy-details/) - Apple defines 'collect' as transmitting data off the device in a way that lets the developer or its third-party partners access it longer than needed to service the request in real time. Data that is only processed on-device, or relayed transiently, is not 'collected'; data sent to a third-party API that retains it, or that is logged server-side, counts. (medium confidence) — [source](https://developer.apple.com/app-store/app-privacy-details/) - Third-party partners whose code is integrated, plus any third-party service the app sends data to, must be reflected in the label. Data is treated as linked to the user (account, device, or other identifier) unless de-identified before collection. (medium confidence) — [source](https://developer.apple.com/app-store/app-privacy-details/) - On 24 Jul 2025 Apple replaced the 12+/17+ tiers with 4+, 9+, 13+, 16+ and 18+, added required questions on in-app controls, capabilities, medical/wellness and violent themes, and set a 31 Jan 2026 deadline; developers who had not answered would be blocked from submitting updates. (high confidence) (verified as of 2025-07-24) — [source](https://developer.apple.com/news/?id=ks775ehf) - Under the age ratings reference, 'Unrestricted Web Access' and frequent medical/treatment info push an app to 16+; Advertising, messaging and user-generated content alone stay at 4+. A developer may set a higher minimum age than Apple's calculated rating after answering the questions. A utility with no web browsing, UGC or mature themes should compute 4+. (medium confidence) — [source](https://developer.apple.com/help/app-store-connect/reference/app-information/age-ratings-values-and-definitions) - As of 9 Jul 2026 Apple added social-media-capability questions to the age rating questionnaire (for Time Allowances); reporting says answers become required from September 2026. Apple's release notes as read here did not state the mandatory date, and the reporting covers iOS only, so applicability to a Mac utility is unconfirmed. (low confidence) (verified as of 2026-09-13) — [source](https://developer.apple.com/help/app-store-connect/release-notes/) - Every developer with at least one app on the App Store in the EU must declare DSA trader or non-trader status in App Store Connect (Business > Agreements > Compliance) by Account Holder or Admin; enforcement began 17 Feb 2025, with removal from EU storefronts for undeclared apps. Status can be set per app. (high confidence) (verified as of 2026-10-02) — [source](https://developer.apple.com/help/app-store-connect/manage-compliance-information/manage-european-union-digital-services-act-compliance-information) - Apple says apps distributed only outside the EU, via TestFlight or alternative channels do not make the developer a trader for DSA purposes; but the declaration is still required whenever any app is on the EU App Store. A commercial Mac utility sold by a business should declare trader. (medium confidence) — [source](https://developer.apple.com/help/app-store-connect/manage-compliance-information/manage-european-union-digital-services-act-compliance-information) - Apple documents that encryption built into the OS, e.g. HTTPS via URLSession, is typically exempt from export documentation upload; proprietary encryption is not. Set Info.plist ITSAppUsesNonExemptEncryption to NO if the app (including linked third-party libraries) uses no encryption or only exempt forms, else YES. Without the key, App Store Connect asks every submission. (high confidence) — [source](https://developer.apple.com/tutorials/data/documentation/security/complying-with-encryption-export-regulations.md) - Apple's overview notes France separately controls secure storage, secure communications and anti-virus apps (banking and medical exempt); distributing a security-oriented utility in France may add French requirements. (low confidence) — [source](https://www.developer.apple.com/help/app-store-connect/manage-app-information/overview-of-export-compliance)