Guideline 5.1.1 and 5.1.2(i) privacy purpose strings and third-party AI data-sharing consent
Parent: App Review Privacy, AI Consent and Rejection Playbook · Published reference · snapshot 2026-10-02
↓ Facts as markdownall context files
Source-anchored research for Guideline 5.1.1 and 5.1.2(i) privacy purpose strings and third-party AI data-sharing consent. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- Triggering the API call before the consent prompt is shown is a reported technical rejection cause: consent must precede the first transmission, including prefetch or warm-up requests. (low confidence) (verified as of 2026-05-06) [source]
- Missing purpose strings for protected-resource APIs cause App Store Connect upload errors such as ITMS-90683 ('Missing purpose string in Info.plist'), including when a linked SDK merely references the API. This is binary validation, separate from the 5.1.2(i) consent UI. (low confidence) [source]
Facts and statements
- Guideline 5.1.2(i) states: 'You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so.' (high confidence) (verified as of 2025-11-13) [source]
- The 'including with third-party AI' wording was added as a clarification in the Nov 13, 2025 App Review Guidelines update, which also changed 5.1.1(ix) (crypto exchanges). (high confidence) (verified as of 2025-11-13) [source]
- Guideline 5.1.1(ii) requires consent for collecting user or usage data even if anonymous, requires an easily accessible way to withdraw consent, and says: 'Ensure your purpose strings clearly and completely describe your use of the data.' (low confidence) [source]
- Guideline 5.1.1(i) requires a privacy policy link in App Store Connect metadata and in-app. The policy must identify what data is collected, how, and all uses; confirm third parties give equal protection; and explain retention/deletion and how to revoke consent. (low confidence) [source]
- 5.1.2(i) also says data collected from apps may only be shared with third parties to improve the app or serve advertising, and that apps may not require users to enable system functionality to use the app. (low confidence) [source]
- Secondary guidance converges on a consent screen that names the provider (e.g. Anthropic), states the concrete data sent, states the purpose, uses an affirmative tap, appears before the first transmission, and offers revocation in settings. Generic 'powered by AI' or 'enhance your experience' wording is reported to be rejected. (medium confidence) (verified as of 2026-05-06) [source]
- On-device AI (Core ML or similar) where no data leaves the device is read as outside the special third-party-AI disclosure. This is a developer interpretation, not Apple text. (low confidence) [source]
- Neither Apple's guideline text nor the secondary articles read address user-supplied (BYO) API keys or macOS specifically. A reader asked about BYO key and got no answer. Safest design: treat the user's own optional Anthropic call as third-party AI sharing and gate it behind an in-app disclosure plus explicit opt-in before the first request. (low confidence) (verified as of 2025-12-25) [source]
Children
- No children recorded.