Guideline 5.1.2(i): third-party AI data sharing consent fix
What App Store Guideline 5.1.2(i) says
Apple's Guideline 5.1.2(i) (Data Use and Sharing) states that, unless otherwise permitted by law, you may not use, transmit, or share someone's personal data without first obtaining their permission, and you must give access to information about how and where the data will be used.
On November 13, 2025, Apple added a clause naming third-party AI directly: you must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so. This made sending personal data to an external AI service a regulated action that requires up-front consent, on top of the existing disclosure rules.
The official text lives on the App Store Review Guidelines page.
Why apps get rejected under 5.1.2(i)
Common triggers, especially for apps that call an external AI:
- The app sends user content or personal data to a third-party AI service with no consent step at all.
- There is a consent screen, but it is vague and does not say the data is shared with a third-party AI.
- The privacy policy does not disclose the AI data sharing, or is too generic to identify it.
- The App Privacy answers in App Store Connect do not reflect that data is shared with a third party.
- The consent text and the app's real behavior do not match, for example consent is requested for less than what is actually sent.
The common thread is that personal data reaches a third party, an AI provider in this case, without clear disclosure and explicit, up-front permission.
How to fix it
- Add an explicit consent step. Before any personal data is sent to an external AI, present a clear prompt that says what is shared and with whom, and proceed only after the user agrees.
- Name the third-party AI sharing plainly. Tell the user their data will be processed by a third-party AI service. Avoid vague wording like "to improve your experience."
- Disclose it in the privacy policy. Add a clear section covering what data goes to the AI provider, why, and the protection that applies, consistent with Guideline 5.1.1.
- Reconcile your App Privacy answers. Make sure the App Privacy details in App Store Connect reflect the third-party sharing, so nothing contradicts the policy or the app.
- Minimize what you send. Share only the personal data the feature actually needs, and consider whether some processing can stay on device.
- Test that the data only leaves after consent before resubmitting.
Remember that submitted is not approved. Clear disclosure and explicit consent are what the rule asks for, but Apple checks the consent flow and the disclosures on resubmission.
How AppFlight helps
You bring your own AI to AppFlight, Claude Code or Codex, and that AI runs locally on your Mac to build the app, with calls going straight to your provider; AppFlight never proxies or reads them. That is separate from any AI feature inside the app you ship, which is what Guideline 5.1.2(i) governs. When you wire an AI feature into your app through an integration like OpenAI, the user data that feature sends to a third-party AI is exactly what needs a consent step and disclosure. When Apple returns a 5.1.2(i) rejection, AppFlight reads the rejection reason, works on the consent flow and the disclosures, and resubmits the build. AppFlight does not guarantee approval. Apple reviews every app and every resubmission, and the consent and disclosures have to genuinely match the data sharing.
FAQ
What changed in Guideline 5.1.2(i) for AI apps?
On November 13, 2025, Apple added explicit language requiring you to clearly disclose where personal data will be shared with third parties, including third-party AI, and to obtain explicit permission before doing so. Sending user data to an external AI service is now a regulated, consent-gated action.
Does this apply if I use OpenAI, Gemini, or Claude in my app?
If your app sends a user's personal data to any external AI service to generate a response, the third-party AI clause applies. You must disclose that sharing and get the user's explicit permission first. The detail that matters is whether personal data leaves the device to a third party.
Is a line in my privacy policy enough to comply?
Disclosure in the policy is required but not sufficient on its own. Apple wants explicit permission before the data is shared, which means a clear in-app consent step, not just a buried policy line. The consent, the policy, and your App Privacy answers all need to agree.