App Store 5.1.1 rejection: Data collection, permissions, and account deletion

Apple’s 5.1.1 covers enough different things that the number alone isn’t a diagnosis. Look for the Roman numeral and the reviewer’s description. We’d identify that clause before rebuilding: a missing policy link, an unnecessary permission, and an account-deletion problem need different work.

5.1.1(i): the privacy policy

Provide an accessible policy link both in the app and in App Store Connect. Explain collection, use, sharing, retention, deletion, and withdrawing consent. The policy must address equivalent protection by parties receiving the data. Check actual SDK behavior before copying a generic policy template.

5.1.1(ii): consent and purpose strings

Obtain the required collection consent, including for usage data described as anonymous. Make withdrawing it understandable and accessible. Permission purpose strings need to explain the real use of the data. Paid functionality can’t depend on granting access to this data. If relying on a legal basis such as legitimate interests, meet the applicable law’s conditions rather than assuming the phrase waives consent requirements.

5.1.1(iii): collect only what the task needs

Request data relevant to core functionality and limit collection to the task. Use a system picker or share sheet where it can replace broad Photos or Contacts access. For example, choosing one profile picture shouldn’t automatically mean reading the whole library.

5.1.1(iv): respect refusal

Keep permission choices meaningful. Don’t require an unrelated permission to use a feature. Where possible, offer a workable alternative, such as entering an address when location is declined. Test refusal as carefully as acceptance.

5.1.1(v): login and account deletion

Allow use without login when the app lacks significant account-based features. Apps supporting account creation must offer account deletion inside the app. Collect personal details only when relevant to core functionality or required by law.

A social-network login must not be the only route when that network isn’t central to the app. Apple also requires a way to revoke social credentials and access inside the app, and restricts off-device storage and use of those social credentials. Check your authentication architecture against the precise clause.

Use the account-deletion rejection guide for the full deletion flow. Disabling or signing out of an account doesn’t demonstrate deletion.

5.1.1(vi): covert collection

Remove behavior that secretly discovers passwords or other private information. Inspect third-party code and involve security specialists if necessary. This is a data-handling issue, not a wording fix.

5.1.1(vii): visible Safari views

SafariViewController must visibly present information. It can’t be concealed behind other views or used for tracking without the user’s knowledge and consent. Test the actual presentation and associated requests.

5.1.1(viii): compiled personal information

Apple prohibits compiling personal information from sources other than the user, or without the user’s explicit consent, including public databases. Public availability alone doesn’t establish permission to build a profile product.

5.1.1(ix): regulated services and sensitive information

Covered regulated or sensitive-data services should be submitted by the legal entity providing the service, rather than an individual developer. Match the account with the actual provider and supply relevant evidence. Legal cannabis sales also require geographic restrictions to the appropriate jurisdiction.

5.1.1(x): optional contact details

Basic contact requests must be optional, with features available if someone declines, and must meet the other privacy rules. Test the skip route instead of assuming a field marked “optional” is optional in practice.

Verify the cited correction

Use test accounts to exercise consent, refusal, withdrawal, sign-in, or deletion as relevant. Inspect the data flow and saved result. Give Apple the exact screen and steps, and explain whether the correction was in the binary, backend, or metadata.