Guideline 5.4 prohibits VPN apps from selling, using, or disclosing user data to third parties for any purpose, requires this commitment in the app's privacy policy, and mandates use of the NEVPNManager API. Non-compliance results in app removal from the App Store and blocking from alternative distribution.
This analysis describes what Apple's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision asserts an absolute prohibition on third-party data sharing for VPN apps, which extends beyond standard data minimization or purpose limitation requirements to bar any third-party data use regardless of purpose, including analytics, fraud prevention, or service provider relationships. The enforcement consequence includes blocking from alternative distribution channels, not only App Store removal.
The updated guidelines do not directly affect end users of apps, but they establish new requirements for developers submitting apps to the App Store. Developers must now provide regulatory documentation for apps requiring approval, implement content moderation safeguards for user-generated content and AI content creation platforms, and ensure all app information and creative assets meet specific accuracy and appropriateness standards. Developers who fail to implement safeguards or remediate violations after notice may be considered in violation of the Developer Code of Conduct, potentially resulting in app removal or account termination.
View change record →⚠ VPN apps that do not comply will be removed from the App Store and blocked from installing via alternative distribution.
⚠ Developer accounts may be removed from the Apple Developer Program for non-compliance.
Cross-platform context
See how other platforms handle VPN App Data Prohibition and similar clauses.
Compare across platforms →"Apps offering VPN services may not sell, use, or disclose to third parties any data for any purpose, and must commit to this in their privacy policy. VPN apps must not violate local laws, and if you choose to make your VPN app available in a territory that requires a VPN license, you must provide your license information in the App Review Notes field. Parental control, content blocking, and security apps, among others, from approved providers may also use the NEVPNManager API. Apps that do not comply with this guideline will be removed from the App Store and blocked from installing via alternative distribution and you may be removed from the Apple Developer Program.Excerpt from Apple's App Store Review Guidelines
(1) REGULATORY LANDSCAPE: This provision engages GDPR data minimization and purpose limitation principles (Articles 5 and 25, GDPR) and CCPA data sharing and sale restrictions for California residents.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision asserts an absolute prohibition on third-party data sharing for VPN apps, which extends beyond standard data minimization or purpose limitation requirements to bar any third-party data use regardless of purpose, including analytics, fraud prevention, or service provider relationships. The enforcement consequence includes blocking from alternative distribution channels, not only App Store removal.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Apple.