Home > Blogs > Apple App Store Privacy Requirements - The Rules

Apple App Store Privacy Requirements - The Rules

From SDKs and APIs to purpose strings and parental gates, Apple has its own requirements that supplement the UK GDPR when it comes to getting your app approved on the Apple App Store in the UK.

If you have a budding smartphone app and want to get listed on Apple’s App Store in the UK, you must comply with Apple’s App Guidelines in relation to privacy, as well as adhere to UK data protection laws (e.g. GDPR). A failure to comply with the same may lead to the removal of your developer privileges under the Apple Developer programme and a refusal of your app on the App Store.

This article will explain some of the key requirements to follow from the purview of Apple’s privacy requirements, including any disclosure requirements, and in what ways it may depart or diverge from UK data protection laws.

For rules in relation to the Google Play Store, see our blog here.

Transparency requirements and consent

Section 5 of Apple’s App Guidelines contain rules on privacy with many of them relating to transparency obligations. As a whole, these mirror the laws apparent in the UK GDPR, and so app owners are expected to have a publicly accessible privacy policy in place and obtain the informed consent from users to process their data where necessary.

However, the Apple App Guidelines are more prescriptive as to how the transparency duties manifest during practical use of your app. Apple mandates the use of ‘purpose strings’ for obtaining informed consent from users. These are descriptions of what enabling certain phone permissions (e.g. location) for the app will do. Purposes strings must also be ‘localised’ which means that users in their native countries must be able to read them in their native languages. Apple promotes the use of artificial intelligence for app localisation here.

There is also a divergence from UK data protection laws insofar as the processing of personal data that is considered anonymous at the time of collection which requires the prior consent of users. Ordinarily, under UK laws, no consent would be required for processing such data because anonymised data is not personal data. Thus, Apple goes further than the UK GDPR here.

The Apple App Guidelines also contain special rules on transparency and consent in relation to children via the use of ‘parental gates’. This is functionality which prevents further use of the app until a parent or guardian takes control. The initial layer of such functionality should be something which makes the child understand to get their parent. These requirements seem to mirror the requirements under the ICO’s Children’s Code.

SDKs and APIs

There are specific rules in the Apple App Guidelines in relation to third-party SKDs and APIs used within apps. The purpose behind these rules is to ensure that developers and app owners identify what third-party tools they use within their apps and how they use personal data from their users. For example, SDKs may contain tracking technology in them which, similar to cookies on a web browser, track user behaviour for marketing purposes. Apple takes the view that the app owner is responsible for the privacy requirements of these third-party tools, even though they are not the ultimate controller of such. 

Social media connectivity

The Apple App Guidelines have rules in relation to user connectivity with third-party accounts such as social media profiles. The general purpose behind these rules is that Apple does not want to force users of an app to have accounts with other platforms just to use the app. Therefore, where social connectivity is not necessary for the ‘core functionality’ (which excludes pulling basic profile information, sharing to social networks, or inviting friends to use the app), users must have another way to use the app, such as creating their own account, using ‘sign in with Apple’, or using the app without logging in. This is generally in line with the UK GDPR principle of data minimisation.

Stalker apps

The Apple App Guidelines go further than UK law insofar as the prohibition of apps that collect personal information from any source that is not directly from the user, or without the explicit consent of the user, that exists on those third-party sources, even public databases. This is because Apple does not want people to be able to search for other people on an app who do not use the app. Strictly speaking, the UK GDPR would allow the processing of personal data from indirect sources, as long as there is a privacy policy in place and a lawful basis to process the same. The Apple App Guidelines therefore diverge from UK law on this point.

Privacy disclosures

As part of the process of being approved to be listed on the Apple App Store, Apple also requires the disclosure of certain mandatory and optional information directly to them in relation to privacy and data protection. The information disclosed here will be accessible by anyone via the app’s App Store listing. Generally, Apple puts more impetus on processing activities which lead to the disclosure of personal data to third parties for advertising purposes. Consequently, this is classed as a mandatory disclosure. Conversely, data that is collected infrequently, is not related to the core functionality of the app, or is optional for the user, need not be disclosed.

Apple App Guidelines and UK laws

Though, generally, the Apple App Guidelines on privacy mirror the laws contained within the UK GDPR, there is some divergence at points. This means that app owners and developers should undertake compliance activities that document and evidence that privacy laws have been and will be complied with both in the Apple sense and the UK GDPR sense.

About the author

Nabiel Junjua (CEO & Solicitor) is a lawyer who specialises in digital law and has experience advising businesses on their consumer law and data protection requirements for their digital content and software applications. You can learn more about Nabiel here and contact him for support on your smartphone app approvals.