Privacy and data rules on the App Store and Google Play
Privacy is the area where most app rejections now start. Both Apple and Google have moved from asking developers to publish a privacy policy to checking that an app's behaviour matches what it says, including the behaviour of the third-party libraries inside it. A single analytics or advertising SDK that sends more data than the listing describes can be enough to fail review on either platform.
Four ideas run through nearly every rule in this area: tell people what you collect, collect only what the feature needs, give them control, and keep the data safe. The individual guidelines below turn those ideas into specific tests. Reviewers can check some of them directly, for example whether a delete-account option exists, while others are checked by watching network traffic or by comparing the privacy label with the code.
Because rules in this area change as laws change, the pages in this section are explanations to help you understand what a rejection message is referring to. They are not legal advice, and the official Apple and Google texts are the final word.
How Apple approaches it
Apple groups most of its privacy expectations under guideline 5.1, with the data-collection and storage rules in 5.1.1, limits on how collected data may be used and shared in 5.1.2, and further rules for health data, children and location. It asks developers to publish a privacy policy, to fill in the App Privacy labels shown on the listing, and to explain every protected-resource request, such as camera or location, with a short purpose string in the app configuration.
Account deletion is the most concrete rule: if an app lets people create an account, it must let them delete that account from inside the app. Apple also separates login choices into their own guideline, 4.8, which concerns apps that rely on a third-party sign-in service.
How Google Play approaches it
Google Play handles the same ground through its User Data policy, the Data Safety section, the Permissions policies and a dedicated account-deletion requirement. The Data Safety form is a declaration the developer completes in Play Console, and Google compares it with what the app and its SDKs actually do. Sensitive permissions such as SMS, call logs and background location need an additional declaration and are limited to apps whose core purpose depends on them.
Google's account-deletion rule has an extra element that surprises many developers: besides the in-app option, there has to be a public web resource where a person can request deletion without installing the app, and its address is entered in Play Console.
Where the two platforms differ
- Apple labels data practices through the App Privacy section of App Store Connect, while Google uses the Data Safety form in Play Console. Both are public summaries on the listing, and both are checked against real behaviour.
- Apple asks for a purpose string for each protected resource in the app's configuration. Google relies on runtime permission prompts and, for sensitive permissions, a declaration reviewed by the policy team.
- Both require in-app account deletion. Only Google also requires a public web page for deletion requests.
- Apple singles out third-party login services with a separate rule. Google has no direct equivalent to that guideline.
- Both hold the developer responsible for what bundled SDKs collect, which is why a library update can change an app's compliance without any change to the developer's own code.
What reviewers typically check
- Whether the privacy policy link opens, is easy to find and describes the data the app really handles.
- Whether an account can be created, and if so whether an account-deletion option can be found by someone who has never used the app.
- Whether each permission prompt appears at a sensible moment and is explained by wording that matches the feature using it.
- Whether the data the app appears to send, including traffic from advertising and analytics libraries, matches the privacy label or Data Safety declaration.
- Whether sensitive categories such as health, location, children's data or biometrics are handled under the stricter rules that apply to them.
Key terms
- Purpose string
- A short sentence, shown in Apple's permission prompt, that explains why an app wants access to a protected resource such as the camera or location.
- App Privacy label
- The summary of data practices shown on an app's App Store page, completed by the developer in App Store Connect.
- Data Safety section
- Google Play's equivalent label, declared in Play Console and shown on the store listing.
- SDK
- A software development kit, meaning third-party code bundled into an app, such as an analytics or advertising library.
- Data minimisation
- The principle that an app should collect only the data it needs for the feature in use.
Common questions
Both stores treat the behaviour of bundled libraries as the app's own. A library can collect data or request permissions that the developer never configured directly.
No. Reviewers compare the policy with what the app actually does, and with the labels or declarations on the listing.
Yes. The requirements do not depend on the size of the app or the developer.
Apple guidelines on this topic
Google Play policies on this topic
Platform rules change often. This page is a plain-language overview written by AppReviewFix, not official guidance. Check the App Store Review Guidelines and the Google Play Developer Program Policies for the exact current wording.