iOS app legal requirements

What Apple asks for before an iOS app goes live, what the law asks for on top, and which of the two rejects more submissions.

Updated 2026-09-18 · Written from the same rules terms.gg uses to generate documents

Two sets of rules, not one

An iOS app answers to the privacy law of the country you operate from, and separately to Apple's own rules. They overlap, but neither is a subset of the other: a policy that satisfies the law can still fail review, and a listing that passes review can still leave you exposed.

What Apple checks

• A privacy policy URL in App Store Connect that loads without a login, and the same link inside the app.
• Privacy labels that match what the app actually collects, including what your SDKs collect.
• An account deletion route inside the app for any app with accounts.
• A EULA, either Apple's standard one or your own carrying their required clauses.
• A support URL that leads to a real way to reach a person.

What the law asks for on top

• The legal ground for what you collect, which no store form asks about.
• Retention periods and what deletion actually removes.
• Every processor that sees the data, and where it runs.
• A route to complain to a regulator, named.

Which one rejects more submissions

In practice the store does, because it checks automatically and immediately. The regulator arrives later, on a complaint, and asks harder questions. Passing review is not evidence that the policy is right.

The country you operate from decides the rest

Which law applies, which authority hears complaints, and whether a published legal notice is expected are all set by where you are established.

Keeping it true after launch

A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. No store re-checks your pages against your build, so the drift is yours to notice.

• Re-read it whenever you add a dependency that sees user data.
• Re-open the Apple console after any change to what the app collects: the listing and the policy have to agree.
• Keep the URL stable. Changing where a policy lives breaks every listing that points at it.