Guideline 4.8 Login Services and Sign in with Apple, in plain English
“must also offer as an equivalent option another login service”
Guideline 4.8 says that if your app lets people set up or sign in to their main account with a third-party or social login, such as Google, Facebook or X, it must also offer another login service as an equal option. That other service has to keep data to a name and email address, let people hide their email, and not track them for ads without consent; Sign in with Apple is the usual way to meet it. Apps that only use their own email-and-password accounts don't need it.
Checked against Apple’s guidelines on (Apple’s version of ). Apple’s reviewers make the final call.
What Guideline 4.8 means
The rule is about the person's primary account: the one they create in your app to identify themselves, sign in and use its features. Apple's examples of third-party logins are Facebook Login, Google Sign-In, Log in with X, Sign In with LinkedIn, Login with Amazon and WeChat Login.
The equal option must have three properties: it limits data collection to the person's name and email address, it lets them keep their email address private when they set up the account, and it doesn't collect their activity in your app for advertising without consent.
Apple lists when no other login is needed: your app uses only your company's own account setup and sign-in; it is an alternative app marketplace using its own login; it is an education, enterprise or business app that needs an existing school or work account; it uses a government or industry-backed electronic ID; or it is a client for one specific third-party service where people sign in to that service to reach their own content.
Sign in with Apple also matters when people delete their account. Apple's account deletion guidance says apps that support Sign in with Apple should use its REST API to revoke the person's tokens.
Why apps are turned down under Guideline 4.8
The app offers a social login without an equivalent option
The sign-in screen has Continue with Google or Facebook, and the only alternatives are other third-party logins, or none at all.
The other login option doesn't meet the requirements
The alternative collects more than a name and email, doesn't let people hide their email, or tracks them for advertising without asking.
The equivalent option is hard to find
Apple's wording is "equivalent option". An alternative tucked behind another screen or shown only after the social login fails doesn't read as equivalent.
How to fix it and resubmit
- List every way to sign in to your app and mark which ones are another company's login used for the person's main account.
- Check Apple's exceptions. If one fits, such as a work app that needs an existing company account, explain it in the review notes and reply to App Review.
- Otherwise add Sign in with Apple, or another login with the three privacy properties, next to the social logins on the same screen and at the same size.
- Make account deletion work for every login, and for Sign in with Apple revoke the person's tokens through Apple's REST API when they delete their account.
- Test sign-in, sign-out and deletion with each option on a real iPhone, upload the new build and resubmit.
How Borel helps
The sign-in Borel writes into apps is the app's own: people make an account with their email and a password, kept in the app's Borel cloud, and no Google, Facebook or other third-party login is part of it. Apple says an app that uses only its own account setup and sign-in needs no other login service, so Borel's built-in sign-in doesn't bring 4.8 into play.
Borel's kit doesn't include Sign in with Apple today. If you add a third-party login to a Borel app yourself, 4.8 applies to it and you'd need an equivalent option beside it, so the simplest way to stay clear of 4.8 is to keep the built-in email sign-in. Every Borel app with accounts also has Delete Account and a reviewer account, which the account deletion and demo account pages explain.
Questions people ask
Is Sign in with Apple required for every app?
No. Guideline 4.8 only applies when the app uses a third-party or social login for the person's main account. An app with its own email-and-password sign-in, or no sign-in at all, doesn't have to offer it.
Does it have to be Sign in with Apple, or can it be another login?
Apple asks for another login service that limits data to name and email, lets people keep their email private, and doesn't track them for ads without consent. Sign in with Apple is the common choice, but the guideline describes the properties rather than naming one service.
My app is a client for one service, like an email account. Does 4.8 apply?
No. Apple exempts apps that are clients for a specific third-party service, where people sign in to their mail, social media or other account directly to reach their own content.
What happens to Sign in with Apple when someone deletes their account?
Apple's guidance says apps that support Sign in with Apple should revoke the person's tokens with the Sign in with Apple REST API when the account is deleted.
Related guidelines
Read more
Words on this page
Make an iPhone app that's ready for review
Describe the app you want and see its first screens before you pay anything.
See your app free