App legal requirements in the United States
Which privacy law applies to an app run from the United States, who enforces it, the pages you must publish, and what each store adds on top.
The short answer
An app operated from the United States answers to applicable United States state privacy laws, including the California Consumer Privacy Act as amended (CCPA/CPRA), enforced by the California Privacy Protection Agency or your state Attorney General. On top of that, each store you ship on has its own requirements, which are contract terms rather than law and are stricter in places.
Put together, a paid app on both stores from the United States publishes 6 pages: Privacy Policy, Terms of Service, Account and data deletion page, Cookie Policy, Refund Policy, End User License Agreement.
What is specific to the United States
- Law that applies: applicable United States state privacy laws, including the California Consumer Privacy Act as amended (CCPA/CPRA).
- Who enforces it: the California Privacy Protection Agency or your state Attorney General.
- Language your users read: English. Terms and a privacy policy in a language your buyer does not speak are worth little, whatever they say.
- Published legal notice: not generally required in the United States; the operator details live in the privacy policy and the terms.
- Pages this produces: Privacy Policy, Terms of Service, Account and data deletion page, Cookie Policy, Refund Policy, End User License Agreement.
- Cookies and SDK identifiers: disclosure is the main duty; prior consent is required in fewer situations than under the GDPR.
What each store asks for on top
- A privacy policy URL in App Store Connect and in the Play Console, reachable without signing in.
- A deletion page on the open web, which Google Play asks for and which most rejected submissions were missing.
- An end user licence agreement, either Apple's standard one or your own carrying Apple's required clauses.
- Data safety answers in the Play Console that agree with the policy, word for word where it matters.
The order to do it in
- Write down what the app actually does with data. Everything else is derived from this.
- Generate or write the pages, and put them somewhere permanent.
- Paste the URLs into App Store Connect and the Play Console.
- Fill in the data safety form so it agrees with the policy.
- Read the pages once, properly, before you submit.
Where people go wrong
- Using a US template, which names the wrong law and offers rights that do not exist here.
- Publishing a deletion route that lives only inside the app, which Google Play rejects.
- Store metadata that says less than the policy does.
- A hosting link that expires a few months after launch.
Keeping it true after launch
A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. Under CCPA/CPRA the drift is yours rather than your vendor's, and the California Privacy Protection Agency or your state Attorney General is who hears about it.
- Re-read it whenever you add a dependency that sees user data.
- Re-check what loads on the page after any change: the cookie notice and the policy have to agree.
- Keep the URL stable. Changing where a policy lives breaks every listing that points at it.
Common questions
Does CCPA/CPRA apply if my company is elsewhere but I live in the United States?
In the United States the question is not only where you are. California's CCPA reaches a business that does business there and passes one of three thresholds: roughly 26.6 million dollars of annual revenue, the personal information of 100,000 California residents or households, or half its revenue from selling or sharing personal information. An app under all three is outside it, wherever it is based, and the other states draw their own lines. Being American does not put you in; being foreign does not keep you out.
Do I need a lawyer?
Not to publish a first version. You do once there is revenue, staff, or a complaint, and the generated documents are a much better starting point for that conversation than a blank page.