The short version
In the twelve months to October 2026, Apple updated the guidelines four times: on 13 November 2025, 6 February 2026, 8 June 2026 and 16 October 2026. The changes most apps should know about:
- Personal data shared with a third-party AI service needs a clear disclosure and explicit permission first (5.1.2(i)).
- Content moderation now explicitly covers nonconsensual intimate imagery, including images made with AI tools (1.2).
- A new rule, 2.5.19, targets apps that hide features during review and change after approval.
- A new rule, 2.3.14, covers the new creative assets: product page headers and search result images.
- You cannot use another developer’s icon, brand or product name in your app’s icon or name without their approval (4.1(c)).
16 October 2026
Apple published a changelog and a separate post on nonconsensual intimate imagery and bait-and-switch apps.
- 1.2 User-Generated Content: moderation requirements now explicitly cover nonconsensual intimate imagery, including imagery generated with AI tools, as content apps must proactively prevent and remove. Developers who fail to put adequate safeguards in place, or do not fix violations after notice, risk breaking the Developer Code of Conduct.
- 2.3.14 Creative assets (new): a rule for the new product page header and search result assets. They must relate to the app’s content, functionality or brand, follow the usual metadata rules and suit all audiences, with no misleading references to other apps, unverifiable claims or specific or discounted prices. See our guide to creative assets.
- 2.5.19 Hidden features (new): no hidden, dormant or undocumented features. Apple says this clarifies a long-standing policy formerly covered in 2.3.1, aimed at apps that misrepresent what they do during review and change after approval. The penalty is removal from the App Store and from the Developer Program.
- 3.1.1(a): the Music Streaming Services Entitlement bullet is now part of the StoreKit External Purchase Link Entitlement bullet, and Apple clarified that links may go to a permitted destination.
- Section 5: apps that facilitate human trafficking or the exploitation of children are removed from the App Store and blocked from alternative distribution.
What to do: if people can generate or upload images in your app, check that filtering, reporting and blocking are in place and that reports are acted on. And ship nothing that is switched off during review.
8 June 2026
Released at WWDC, alongside a new Developer Program License Agreement.
- Introduction: revised guidance on the safety of kids and teens.
- 1.2: a new paragraph on developers’ responsibility for content that violates the guideline.
- 4.3(a) and 4.3(b): the reasoning behind the spam rule is spelled out, with new examples.
- 4.5.3: Live Activities may not be used to spam, phish or send unsolicited messages.
The license agreement changed the same day, including updated requirements for using the Foundation Models framework. What to do: if you publish several similar apps, read 4.3 again; and keep Live Activities for live information, not marketing.
6 February 2026
A single clarification: apps with random or anonymous chat are subject to guideline 1.2 on user-generated content. Guideline 1.2 also says that apps used primarily for random or anonymous chat do not belong on the App Store.
13 November 2025
The largest update of the year for most apps:
- 1.2.1(a) (new): creator apps must let people identify content above the app’s age rating, and restrict underage users with a mechanism based on verified or declared age.
- 2.5.10: deleted. It used to forbid empty ad banners and test advertisements.
- 3.2.2(ix): loan apps may not charge a maximum APR above 36%, including costs and fees, or require repayment in full in 60 days or less.
- 4.1(c) (new): you cannot use another developer’s icon, brand or product name in your app’s icon or name without their approval.
- 4.7, 4.7.2 and 4.7.5: HTML5 and JavaScript mini apps and mini games are in scope, and software not embedded in the binary may not expose native APIs without permission and needs age identification and restriction.
- 5.1.1(ix): crypto exchanges join the list of highly regulated fields, which must be submitted by a legal entity.
- 5.1.2(i): you must clearly disclose where personal data is shared with third parties, including third-party AI, and get explicit permission before doing so.
What to do: for an AI app, put the disclosure and the permission step before the first request that sends a photo or text to an outside model. We plan this into every AI app we build.
Other App Store requirements that changed
Not every rule lives in the guidelines. These changed in the same period:
- Minimum SDK: since 28 April 2026, iOS apps uploaded to App Store Connect must be built with the iOS 26 SDK or later. From April 2027, Apple requires the iOS 27 SDK or later, targeting iOS 15 or later.
- Age rating: the questionnaire now asks about social media capabilities, and answers are required for submissions from September 2026. Apps with these capabilities get a minimum rating of 13+ unless the features are off for under-13s, checked with the Declared Age Range API (details).
- iPhone Duo screenshots: required from April 2027. See getting ready for iPhone Duo.
A five-minute check for your own app
- Personal data sent to a third-party AI service: disclosed, with explicit permission first.
- People or AI can create content: filtering, reporting with timely responses, blocking and published contact details.
- Creator content: a way to identify content above the age rating, and age restriction.
- Another brand in your name or icon: written approval, or a new name.
- Nothing in the binary that behaves differently after review.
- Built with a current SDK, and the age rating questionnaire answered.
Sources: Apple’s App Review Guidelines and the Apple Developer news posts linked above.
Related: Why apps get rejected by App Store review · App Store creative assets · AI app development