Guideline 5.1.2 Data Use and Sharing, in plain English

What Guideline 5.1.2 means

Part (i) is the core. People must be able to see how and where their data is used, and data may only be shared with third parties to improve the app or serve advertising, within Apple's license agreement. An app may not make people turn on push notifications, location services or tracking to use it, or to earn rewards such as gift cards.

The AI clause matters for any app that sends words, photos or voice to an AI model run by another company. The app must say that it does, and to whom, and get explicit permission before the first time.

The other parts limit what you do with data: no repurposing it without fresh consent (ii), no secretly building profiles or re-identifying anonymous users (iii), no building contact databases from Contacts or Photos, and no collecting which other apps are installed for analytics or ads (iv), and no messaging people from someone's contacts unless that person chooses to, one by one (v).

Data from sensitive frameworks has its own limits: Apple's part (vi) says data from tools such as HomeKit, health records, ClassKit or face and depth mapping may not be used for marketing, advertising or use-based data mining.

Why apps are turned down under Guideline 5.1.2

• The app shares data with a third-party AI service without asking

  What people type, photograph or record goes to an AI provider with no explanation or permission first.

• The app tracks people without App Tracking Transparency

  It uses the advertising identifier or shares data for tracking without showing Apple's permission prompt.

• The app requires a permission to work

  Notifications, location or tracking must be turned on before the app opens, or to claim a reward.

How to fix it and resubmit

1. Map where personal data goes: every outside service, SDK and AI provider the app sends data to.
2. Before the first time the app shares data with an AI or other third party, show a clear question that says what is sent and to whom, and send nothing unless the person agrees.
3. Let the rest of the app work when someone says no, and give them a way to change their mind later.
4. Remove tracking, or show the App Tracking Transparency prompt before it, and stop requiring permissions to use the app.
5. Update the privacy policy and App Privacy answers to match, describe the data flow in the review notes, and resubmit.

How Borel helps

The AI Borel puts in apps goes through Borel's AI kit, which asks before the first AI request of each kind. The question says what will be sent and names the AI company, nothing is sent unless the person taps Allow, and saying no keeps the rest of the app working.

Borel's submit gate won't send an app to Apple if it sends what people type or pick to AI without that question, and the review notes it drafts tell the reviewer what is sent, to which company, and that the app asks first. Borel's apps tell Apple they never track people, and Stamp flags any tracking request in the code before you publish.

Questions people ask

Related guidelines

• Guideline 5.1.1Data Collection and Storage
• Guideline 5.1.1(ii)Permission and purpose strings
• Guideline 1.2User-Generated Content