Guideline 5.1.1(ii) requires apps to obtain user consent before collecting any user or usage data, including data considered anonymous at collection, and prohibits conditioning paid functionality on consent to data collection. Apps must provide a mechanism for users to withdraw consent and must describe data use clearly in purpose strings.
This analysis describes what Apple's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision requires consent for data collection regardless of whether the data is classified as anonymous at the time of collection, which is a broader consent trigger than some regulatory frameworks apply. The prohibition on conditioning paid functionality on data access consent establishes a platform-level data minimization standard applicable to all App Store apps.
The updated guidelines do not directly affect end users of apps, but they establish new requirements for developers submitting apps to the App Store. Developers must now provide regulatory documentation for apps requiring approval, implement content moderation safeguards for user-generated content and AI content creation platforms, and ensure all app information and creative assets meet specific accuracy and appropriateness standards. Developers who fail to implement safeguards or remediate violations after notice may be considered in violation of the Developer Code of Conduct, potentially resulting in app removal or account termination.
View change record →⚠ Apps that collect data without user consent or condition paid functionality on data access may be removed from the App Store.
⚠ Apps that share user data without consent may be removed from sale and the developer may be removed from the Apple Developer Program.
Cross-platform context
See how other platforms handle User Data Collection Consent and Permission Requirements and similar clauses.
Compare across platforms →"Apps that collect user or usage data must secure user consent for the collection, even if such data is considered to be anonymous at the time of or immediately following collection. Paid functionality must not be dependent on or require a user to grant access to this data. Apps must also provide the customer with an easily accessible and understandable way to withdraw consent. Ensure your purpose strings clearly and completely describe your use of the data.Excerpt from Apple's App Store Review Guidelines
(1) REGULATORY LANDSCAPE: This provision engages GDPR consent requirements (Article 6 and Article 7, GDPR), CCPA data collection disclosure obligations, and Apple's App Tracking Transparency (ATT) framework, which is referenced explicitly in Guideline 5.1.2(i).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision requires consent for data collection regardless of whether the data is classified as anonymous at the time of collection, which is a broader consent trigger than some regulatory frameworks apply. The prohibition on conditioning paid functionality on data access consent establishes a platform-level data minimization standard applicable to all App Store apps.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Apple.