Even data collected with proper consent has limits: it can only be used for the purpose disclosed at collection time, and third-party data brokers, ad networks, or data-selling arrangements need explicit disclosure.
Often triggered by an SDK (analytics, ads) sending more data off-device than the app's own privacy policy discloses, which reviewers can catch via network traffic inspection.
"Your app collects user or device data without prior user consent, or shares data with a third party in a way not disclosed in your privacy policy."
Guideline 5.1.2 limits what an app may do with data after it has been collected. Even with consent, data may be used only for the purpose disclosed when it was collected, and sharing with third parties such as ad networks or data brokers has to be disclosed. A frequent cause of rejection is an SDK that sends more data off the device than the privacy information states.
Consent is only meaningful if it is specific. A person who agrees to share location for a map feature has not agreed to have it sold to advertisers. The guideline connects collection, purpose and sharing so that disclosures match reality, and it makes the developer responsible for what third-party components do. Reviewers can often detect the difference by watching network traffic during testing.
A summary of data practices shown on the App Store listing, which must be accurate.
Only as disclosed and consented to, within the rules.
Through testing, analysis and reports from users or researchers.
Platform rules change often. This page is a plain-language explanation written by AppReviewFix, not official guidance. Check the current App Store Review Guidelines for the exact wording.