App Store AI consent requirement in 2026: what apps must do
What the App Store AI consent requirement says
Guideline 5.1.2(i) covers data use and sharing. It states that, unless otherwise permitted by law, you may not use, transmit, or share someone's personal data without first obtaining their permission, and you must give access to information about how and where the data will be used.
On November 13, 2025, Apple added a clause that names third-party AI directly: you must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so. That made sending personal data to an external AI service a regulated action requiring up-front consent, on top of the existing disclosure rules. The official text lives on the App Store Review Guidelines page.
Why apps get rejected under it
Common triggers for apps that call an external AI:
- The app sends user content or personal data to a third-party AI service with no consent step at all.
- There is a consent screen, but it is vague and does not say the data is shared with a third-party AI.
- The privacy policy does not disclose the AI data sharing, or is too generic to identify it.
- The App Privacy answers in App Store Connect do not reflect that data is shared with a third party.
- The consent text and the app's real behavior do not match, for example consent asks for less than what is actually sent.
The common thread is that personal data reaches a third party, an AI provider in this case, without clear disclosure and explicit, up-front permission.
How to fix it
- Add an explicit consent step. Before any personal data is sent to an external AI, present a clear prompt that says what is shared and with whom, and proceed only after the user agrees.
- Name the third-party AI sharing plainly. Tell the user their data will be processed by a third-party AI service, rather than using vague wording like "to improve your experience."
- Disclose it in the privacy policy. Add a clear section covering what data goes to the AI provider, why, and the protection that applies.
- Reconcile your App Privacy answers. Make sure the App Privacy details in App Store Connect reflect the third-party sharing, so nothing contradicts the policy or the app.
- Minimize what you send. Share only the personal data the feature needs, and consider whether some processing can stay on device. Test that data only leaves after consent before resubmitting.
Remember that submitted is not approved. Clear disclosure and explicit consent are what the rule asks for, but Apple checks the consent flow and the disclosures on resubmission.
How AppFlight helps
The AI that builds your app in AppFlight, Claude Code or Codex, runs locally on your Mac, and calls go straight to your provider; AppFlight never proxies or reads them. That build-time AI is separate from any AI feature inside the app you ship, which is what this requirement governs. When you wire an AI feature into your app through an integration like OpenAI, the user data that feature sends to a third-party AI is exactly what needs a consent step and disclosure. When Apple returns a 5.1.2(i) rejection, AppFlight reads the rejection reason, works on the consent flow and the disclosures, and resubmits the build. AppFlight does not guarantee approval. Apple reviews every app and every resubmission, and the consent and disclosures have to genuinely match the data sharing.
FAQ
What changed for AI apps in the App Store rules?
On November 13, 2025, Apple updated Guideline 5.1.2(i) to name third-party AI directly. You must clearly disclose where personal data will be shared with third parties, including third-party AI, and obtain explicit permission before doing so. Sending user data to an external AI is now a consent-gated action.
Does this apply to on-device AI?
The requirement is about personal data leaving the device to a third party. If your AI runs entirely on device and shares nothing, the third-party AI clause is not triggered. The detail that matters is whether personal data is sent to an external service.
Is one line in my privacy policy enough?
No. Disclosure in the policy is required but not sufficient. Apple wants explicit permission before the data is shared, which means a clear in-app consent step. The consent, the policy, and your App Privacy answers all have to agree.