Apps that let users sign in with a third-party service such as Google or Facebook for account creation are required to also offer Sign in with Apple as an equivalent option, with equivalent visual prominence, with limited exceptions.
Why apps actually get flagged
Very commonly caught when an app adds "Sign in with Google" or a social login SDK without also adding Sign in with Apple alongside it.
A real example
"Your app uses a third-party login service but does not offer Sign in with Apple as an equivalent option, per guideline 4.8."
The short version, in more detail
If an app offers a third-party or social login such as Google, Facebook or similar as the way to create or sign in to an account, Apple expects an equivalent privacy-focused option to be offered as well. Historically that has meant Sign in with Apple. The idea is that users should have a choice that limits data collection, keeps their email private and does not track them. Reviewers check for it whenever a primary social login is present.
What this guideline covers
Apps that use a third-party or social sign-in service as the main way to set up or access an account.
The conditions an alternative must meet: limiting data to name and email, letting users keep their email private, and not tracking them for advertising.
Exceptions, for example apps that use only their own account system or certain enterprise and education cases.
How the alternative login should work and be presented.
What usually triggers this rejection
The app shows Google, Facebook or another third-party login but no equivalent privacy-focused option.
The only way to create an account is through a third-party service.
An alternative login exists but collects more personal data than the privacy-focused standard allows.
Sign in with Apple is present but does not give full account access or fails during review.
How reviewers evaluate it
Reviewers open the sign-in screen and look at which login options are offered.
If a third-party login is the primary route, they look for an equivalent alternative.
They test that the alternative actually works and gives the same access.
They consider whether an exception applies, such as an app that only uses its own accounts.
Common misunderstandings
The rule is specific to Apple. It is not a Google Play requirement.
It does not apply to apps that only use their own email-and-password accounts, though the current text should be checked.
Sign in with Apple is the common route, but the guideline describes conditions an alternative must meet rather than naming one product.
Common questions
Does email-link sign-in count as a third-party login?
A login that uses the developer's own account system and collects just the email is generally different from a third-party service, but the current text should be checked.
Why did Apple introduce this rule?
It was designed to give users a login choice that limits tracking and data collection, in response to social logins that share a lot of data.
Has the wording changed over time?
Yes. Apple has updated the guideline to allow other equivalent services that meet its conditions, so the current wording matters.
Platform rules change often. This page is a plain-language explanation written by AppReviewFix, not official guidance. Check the current App Store Review Guidelines for the exact wording.
Got this exact rejection?Paste it in and get a diagnosis specific to your app, free.