2.5.12 — CallKit and SMS fraud extension

Apps using the CallKit call-blocking or identification extension, or the SMS and MMS fraud-filtering extension, need to genuinely serve their stated anti-spam purpose — using them to insert unwanted call or message behavior is a direct violation.

Rare, but comes up when a caller-ID app's blocking-list logic is inverted or manipulated in a way that looks like it enables, rather than prevents, spam calls.

The short version, in more detail

Guideline 2.5.12 applies to call-blocking, caller-identification and SMS or MMS filtering extensions. These tools are provided to reduce spam and fraud, so they must actually serve that purpose. Using them to introduce unwanted calls or messages, or to behave in ways that work against the user, is a direct violation. It is rarely seen but treated seriously.

Why this rule exists

Call and message filtering extensions are given unusual access to who is contacting a person and, in some cases, the content of what they receive. That access is justified only because the tools reduce spam and fraud. The rule keeps the extensions pointed at that single purpose and prevents the trust placed in them from being turned toward collecting data or generating unwanted contact, which would undermine the very protection users installed the app to get.

What this guideline covers

• CallKit call-blocking and identification extensions.
• Message-filter extensions for SMS and MMS.
• The expectation that they reduce spam and fraud.
• Handling of the data these extensions process.

What usually triggers this rejection

• A blocking list that is inverted or manipulated.
• Extensions that insert or promote unwanted calls or messages.
• Using the data processed by the extension for unrelated purposes.
• Identification features that mislabel callers.
• Extensions with no real filtering function.

How reviewers evaluate it

• Reviewers look at how the extension behaves when calls or messages arrive.
• They check what data is collected and where it goes.
• They ask whether the stated purpose is genuine.
• Privacy concerns are weighed carefully.

Common misunderstandings

• Having the extension is not enough. It must act as described.
• Collected message data cannot be used as the developer wishes.
• The rule is not about all calling apps, only these extension types.

Common questions