Beyond privacy disclosures, Apple expects a baseline of technical security — data in transit encrypted, sensitive data not left exposed — and requires disclosure if the app has experienced a data breach affecting users.
Why apps actually get flagged
Rare as a standalone rejection, but comes up when a security researcher's public report about an app's data handling reaches Apple before the developer has disclosed or fixed it.
A real example
"Your app transmits user data without adequate security measures in place, which is not permitted per guideline 1.6."
The short version, in more detail
Guideline 1.6 expects apps to protect the data they handle with reasonable security measures and to be open about any breach that affects users. It sits alongside the privacy rules, but it focuses on technical protection rather than disclosure alone. It is rarely cited on its own, but it matters when a security issue becomes public.
What this guideline covers
Reasonable technical safeguards for user data, including encryption in transit.
Protection of sensitive data from unnecessary exposure.
Disclosure to users and Apple when a breach affects them.
How the app handles data stored locally and on servers.
What usually triggers this rejection
A security researcher's public report about weak handling of user data.
Sensitive data sent without encryption.
An undisclosed breach that later comes to light.
Credentials or tokens stored in an exposed place.
Third-party services that leak data from the app.
How reviewers evaluate it
Most issues are found through external reports or app behaviour, not routine review.
Reviewers may look at network behaviour if something appears unsafe.
Breach disclosure is expected to come from the developer.
Serious issues can lead to removal, not only rejection.
Common misunderstandings
Having a privacy policy does not address security by itself.
A small app is not exempt from basic protections.
Disclosure obligations apply even when a breach was caused by a vendor.
Common questions
Is 1.6 often the reason for rejection?
Rarely. It tends to come up when a specific security problem becomes known.
Does Apple test app security directly?
Not in depth for every app, but obvious problems may be noticed.
Must breaches be reported to Apple?
The guideline expects developers to disclose breaches affecting users.
Platform rules change often. This page is a plain-language explanation written by AppReviewFix, not official guidance. Check the current App Store Review Guidelines for the exact wording.
Got this exact rejection?Paste it in and get a diagnosis specific to your app, free.