Apps that let users create an account must also let them delete that account from within the app — not just by emailing support. Apple checks for this explicitly during review.
Why apps actually get flagged
In practice this almost always means: no delete option in Settings, a delete option that only deactivates instead of deletes, or a privacy policy that never mentions deletion at all.
A real example
"Your app supports account creation but doesn't appear to include an option to initiate account deletion. Apps that support account creation must also offer account deletion..."
The short version, in more detail
Guideline 5.1.1 is the home of Apple's privacy and data-handling expectations: tell people what you collect, collect only what you need, protect it, and let them delete it. The rule that causes the most rejections in practice is account deletion. If an app lets people create an account, it must let them delete that account from inside the app, not only by contacting support. Reviewers test this by creating an account and looking for the option.
What this guideline covers
Privacy policy requirements: a link in App Store Connect and inside the app, describing what is collected and how it is used.
Data minimisation: collecting only what the app needs for the feature in use.
User consent for collecting and using data, including where permissions are requested.
Account deletion for apps that support account creation.
Data handling for third-party SDKs bundled in the app.
What usually triggers this rejection
The app supports sign-up but has no delete-account option in the app.
Deletion only "deactivates" the account or hides it while keeping the data.
The delete flow sends people to a website or asks them to email or phone support.
The privacy policy link is missing in App Store Connect or inside the app, or the policy does not match what the app collects.
Data is collected that is not needed for the feature the user is using.
Sign in with Apple is used and Apple's sign-in tokens are not revoked when an account is deleted.
How reviewers evaluate it
Reviewers create an account (or use the demo one) and look for the deletion option in the account or settings area.
They compare the privacy policy and App Privacy labels against what the app appears to collect.
They look at when permissions are requested and whether the request is tied to a feature.
Because it is a clear, testable rule, 5.1.1 is applied consistently and is rarely waived.
Common misunderstandings
Account deletion is not optional for apps with accounts, even if you have a support email.
A privacy policy alone does not satisfy 5.1.1. The app's behaviour has to match it.
Using a social or Apple login does not remove the deletion requirement.
Common questions
Does this apply to apps that only use Sign in with Apple?
Yes. Any app where a person creates an account falls under the deletion expectation.
Is a confirmation step allowed in the delete flow?
A confirmation prompt is generally accepted, but the process is expected to start in the app.
Can data be kept for legal reasons?
Apple's guidance recognises that some records may need to be retained, and expects that to be disclosed in your privacy policy.
Platform rules change often. This page is a plain-language explanation written by AppReviewFix, not official guidance. Check the current App Store Review Guidelines for the exact wording.
Got this exact rejection?Paste it in and get a diagnosis specific to your app, free.