App Privacy nutrition labels age rating export compliance and DSA trader status
Parent: App Review Privacy, AI Consent and Rejection Playbook · Published reference · snapshot 2026-10-02
↓ Facts as markdownall context files
Source-anchored research for App Privacy nutrition labels age rating export compliance and DSA trader status. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- 'Tracking' means linking app data with third-party data for targeted advertising/ad measurement, or sharing with a data broker. An app with no analytics or ads SDKs and no such sharing declares no tracking. (high confidence) [source]
- Trader means acting for trade, business, craft or profession (paid apps, IAP, ads, VAT registration, business activity). Traders have address (D-U-N-S auto-filled for organisations), phone and email shown on product pages in all 27 EU territories, and must complete 2FA email/phone verification plus document upload. Non-traders show 'consumer rights ... won't apply'. (high confidence) [source]
Structure and components
- Disclosure is optional only for data meeting ALL of: not used for tracking, not used for advertising/marketing, collected infrequently and not part of primary functionality and optional, and user-provided with clear consent each time. Optional user-keyed AI calls that are a core feature do not obviously qualify, so default to disclosing the data types sent (e.g. User Content, Diagnostics). (medium confidence) [source]
How it works
- Even with exempt encryption, a year-end self-classification report to US BIS may still be required; it is not needed when non-exempt encryption documentation is provided to Apple. Apple places liability for misclassification on the developer. If the app bundles its own TLS/SMTP crypto library (not OS Network.framework/URLSession), the NO answer needs checking. (medium confidence) [source]
Facts and statements
- All apps, including macOS/Mac App Store apps, must provide App Privacy details in App Store Connect for new submissions and updates, plus a URL to a publicly accessible privacy policy. Account Holder, Admin or App Manager enters them. (high confidence) [source]
- Apple defines 'collect' as transmitting data off the device in a way that lets the developer or its third-party partners access it longer than needed to service the request in real time. Data that is only processed on-device, or relayed transiently, is not 'collected'; data sent to a third-party API that retains it, or that is logged server-side, counts. (medium confidence) [source]
- Third-party partners whose code is integrated, plus any third-party service the app sends data to, must be reflected in the label. Data is treated as linked to the user (account, device, or other identifier) unless de-identified before collection. (medium confidence) [source]
- On 24 Jul 2025 Apple replaced the 12+/17+ tiers with 4+, 9+, 13+, 16+ and 18+, added required questions on in-app controls, capabilities, medical/wellness and violent themes, and set a 31 Jan 2026 deadline; developers who had not answered would be blocked from submitting updates. (high confidence) (verified as of 2025-07-24) [source]
- Under the age ratings reference, 'Unrestricted Web Access' and frequent medical/treatment info push an app to 16+; Advertising, messaging and user-generated content alone stay at 4+. A developer may set a higher minimum age than Apple's calculated rating after answering the questions. A utility with no web browsing, UGC or mature themes should compute 4+. (medium confidence) [source]
- As of 9 Jul 2026 Apple added social-media-capability questions to the age rating questionnaire (for Time Allowances); reporting says answers become required from September 2026. Apple's release notes as read here did not state the mandatory date, and the reporting covers iOS only, so applicability to a Mac utility is unconfirmed. (low confidence) (verified as of 2026-09-13) [source]
- Every developer with at least one app on the App Store in the EU must declare DSA trader or non-trader status in App Store Connect (Business > Agreements > Compliance) by Account Holder or Admin; enforcement began 17 Feb 2025, with removal from EU storefronts for undeclared apps. Status can be set per app. (high confidence) (verified as of 2026-10-02) [source]
- Apple says apps distributed only outside the EU, via TestFlight or alternative channels do not make the developer a trader for DSA purposes; but the declaration is still required whenever any app is on the EU App Store. A commercial Mac utility sold by a business should declare trader. (medium confidence) [source]
- Apple documents that encryption built into the OS, e.g. HTTPS via URLSession, is typically exempt from export documentation upload; proprietary encryption is not. Set Info.plist ITSAppUsesNonExemptEncryption to NO if the app (including linked third-party libraries) uses no encryption or only exempt forms, else YES. Without the key, App Store Connect asks every submission. (high confidence) [source]
- Apple's overview notes France separately controls secure storage, secure communications and anti-virus apps (banking and medical exempt); distributing a security-oriented utility in France may add French requirements. (low confidence) [source]
Children
- No children recorded.