This document outlines the comprehensive App Store Review Guidelines issued by Apple, last updated June 9, 2025, which are essential for developers seeking to distribute apps via the App Store, alternative marketplaces, or direct web distribution (in the EU).
It covers major areas including Safety, Performance, Business, Design, and Legal requirements, as well as pre-submission tips and post-submission procedures.
Key requirements include ensuring user safety and privacy, truthful app representation, correct use of in-app purchases, legal compliance, and maintaining high app quality.
The guidelines apply to all developers targeting Apple platforms, with special considerations for children’s apps, health apps, and regulated industries.
Action Items
Ongoing – All Developers: Review and ensure compliance with all five guideline sections (Safety, Performance, Business, Design, Legal) before app submission.
Ongoing – Developers of Kids Apps: Confirm privacy compliance, restrict third-party analytics/ads, and implement required parental gates.
Ongoing – Apps with In-App Purchases: Disclose all in-app purchase features, follow proper implementation, and keep odds transparent for loot boxes.
Ongoing – Developers Collecting Personal Data: Publish a detailed privacy policy in the app and App Store metadata.
Ongoing – Apps for EU Distribution: Review and apply Notarization and alternative distribution requirements where applicable.
Ongoing – App Review Teams: Stay updated on guideline changes and apply them consistently.
Introduction and Distribution Models
Apple is committed to providing a safe experience for users and robust opportunities for developers through the App Store and alternative distribution methods in the EU.
Developers can distribute via the App Store, alternative marketplaces, or direct web distribution (EU only), with guidelines and legal expectations clearly defined for each.
Before You Submit
Test apps for bugs/crashes.
Ensure metadata is complete and accurate.
Provide App Review with demo accounts or modes as needed.
Keep backend services active for testing.
Clearly document all features/in-app purchases in review notes.
Ensure ongoing support for apps; unsupported/non-functional apps will be removed.
1. Safety
Apps must not contain objectionable, offensive, or false content; strict moderation is required for user-generated content.
Kids Category apps have special restrictions prohibiting third-party ads/analytics and require parental gates and privacy compliance.
Apps must avoid causing physical harm or encouraging dangerous activities; extra scrutiny for medical/drug-related apps.
Developer/Support contact information must be present and accurate.
Strong data security and provision for reporting criminal activity are mandatory.
2. Performance
Apps must be complete, stable, bug-free, and contain accurate, up-to-date metadata.
Beta/demo apps must use TestFlight, not the App Store.
Prohibited to include hidden features or misleading marketing.
In-app purchases and metadata must be described transparently; age ratings and categories must be accurate.
Hardware compatibility, power efficiency, and correct use of APIs/frameworks are required.
Restrictions apply to background processing, web browsing, multitasking, and ad display.
3. Business
In-app purchases are mandated for unlocking features/digital content, with certain exceptions (reader apps, person-to-person services, etc.).
Transparent communication about pricing, subscription terms, and all purchase flows is required.
Manipulation of reviews, rankings, and scam practices result in removal from the App Store and developer program.
Cryptocurrency, NFTs, and similar technologies have specific rules and licensing requirements.
Fundraising, advertising, and financial apps face additional scrutiny and legal expectations.
4. Design
Apps must be original, provide meaningful functionality, and not simply copy others or be minimal repackaged websites.
Spam, template-based, and "storefront" apps violating originality expectations are prohibited.
Apps using extensions or interacting with Apple services (Music, Push Notifications, Game Center, etc.) must comply with additional requirements.
Detailed requirements exist for keyboard extensions, Safari/web extensions, remote desktop clients, and "mini" apps/games.
Monetization of built-in system features or Apple services is not allowed.
5. Legal
All apps must comply with local and international laws regarding privacy, data collection, children’s data, intellectual property, gambling, VPNs, and device management.
Privacy requirements demand specific disclosures, user consent, data minimization, and deletion options.
Health and kids’ data is subject to additional legal and ethical guidelines.
Intellectual property and Apple product likeness violations are grounds for removal.
Stringent rules apply to gambling, lotteries, VPNs, and MDM (Mobile Device Management).
Adherence to Developer Code of Conduct is mandatory; failures can result in expulsion from the program.
After You Submit
App reviews may take longer for complex or non-compliant apps; developers can check status, request expedited reviews for critical cases, and appeal rejections.
Bug fixes will generally not be delayed by guideline violations, except for legal or safety issues.
Channels exist for communication and appeals with App Review.
Decisions
In-app purchases required for unlocking digital content or features — ensures consistent user experience and compliance with App Store business model.
Strict content moderation and privacy requirements for Kids Category and health-related apps — prioritizes child and user safety and data protection.
Removal or blocking of apps violating guidelines or engaging in manipulative/fraudulent practices — maintains trust and platform safety for users and developers.
Open Questions / Follow-Ups
Developers should monitor for future guideline updates and adjust their apps accordingly as the document is described as a "living document."
Developers with complex legal or business models should seek legal advice to ensure compliance in every target region.