If your app uses Face ID or similar biometric matching, that data has to stay within Apple's local authentication APIs — it can't be captured, stored, or transmitted for any other purpose, including a custom facial-match feature.
Apps trying to build a custom facial-recognition feature, rather than using Face ID purely for unlock or authentication, run into this almost immediately during review.
"Your app uses facial recognition technology for a purpose other than device authentication, without complying with applicable privacy requirements, per guideline 2.5.13."
Guideline 2.5.13 limits how facial recognition data may be used. Face ID and similar systems must be used through Apple's local authentication APIs for the purpose they are designed for, such as unlocking. Capturing, storing or transmitting facial data for other uses, such as building a custom matching feature, runs into this rule almost immediately.
A person's face cannot be changed if it is leaked. Biometric data is therefore among the most sensitive information a device can hold, and Apple keeps tight control over how it is used. Face ID matching happens inside protected hardware so that apps receive only a yes or no, never the face data itself. The rule prevents apps from bypassing that design by collecting and processing faces themselves, which would create a new and much riskier store of biometric information.
Yes, through the standard authentication APIs.
Camera-based effects are treated differently, but data handling is still reviewed.
Biometric handling should be described in privacy information.
Platform rules change often. This page is a plain-language explanation written by AppReviewFix, not official guidance. Check the current App Store Review Guidelines for the exact wording.