On October 16, Apple published an update to the App Review Guidelines, the rules every app is reviewed against before it reaches the App Store. There are two new guidelines and changes to three others. Some are clarifications of things that were already enforced, but now they’re in writing, and that changes what can be cited in a rejection.
Summary
| Guideline | What changed | It affects you if… |
|---|---|---|
| 2.3.14 (new) | Rules for creative assets | You use a header or search results asset on your page |
| 2.5.19 (new) | Prohibits hidden, dormant, or undocumented features | You turn features on after review |
| 1.2 | Explicitly covers AI content creation apps and nonconsensual intimate imagery | Your users create, generate, or share content |
| 3.1.1(a) | Merges the entitlements for linking to external purchases | You link to other payment methods |
| 5 (Legal) | Apps that facilitate human trafficking or child exploitation are removed and blocked from alternative distribution | — |
Translations of the guidelines into other languages are coming within the next month.
2.3.14: rules for creative assets
In the first part of the App Store Connect series I covered what creative assets are: the product page header and the search results asset, which Apple turned on on October 5. At the time, the design rules lived in a best-practices guide. Now they have their own review guideline.
Guideline 2.3.14 says creative assets:
- Must relate to your app’s content and functionality, or to your overall brand.
- Follow the same rules as the rest of your metadata.
- Must be appropriate for all audiences.
- Can’t include inappropriate content, references to other apps intended to mislead, unverifiable claims, or specific or discounted pricing.
In practice it’s almost the same as what the best-practices guide asked for. What changes is that it’s now a formal reason for rejection. If one of your assets says “50% off”, “the #1 productivity app”, or shows an award you didn’t win, that’s no longer just bad practice: it’s a rejection with a guideline number.
2.5.19: no hidden features
The new guideline’s text is direct: don’t include hidden, dormant, or undocumented features, and your app’s functionality should be clear to users and to App Review. Hiding features in the binary, for example through code obfuscation, is grounds for removing the app and terminating the developer account.
Apple points out this isn’t a new prohibition: it used to sit inside 2.3.1. It moved it into its own guideline to make clear the case it worries about most, known as bait-and-switch: an app that presents itself as harmless during review and, once approved, turns on something else. Apple’s example is “nudification” apps that generate sexual images of real people without their consent.
For anyone publishing in good faith, the lesson is about process:
- Whatever you turn on after review has to be in the build Apple reviewed. If you use remote config or feature flags, the feature should already be in the binary you submitted, not show up later.
- Describe new features in the Notes for Review. 2.3.1(a) already asked for this “with specificity”, and it says generic descriptions will be rejected.
- If something only shows up under certain conditions (a region, a test account, a paid plan), explain to App Review how to reach it.
1.2: user-generated content, including AI content
Guideline 1.2 already required safeguards for any app where users post content. It now explicitly mentions AI content creation apps, and adds nonconsensual intimate imagery to the risks you have to prevent, including when it’s generated by AI.
If your app lets people create, generate, upload, or share content, you need:
- A filter that keeps objectionable material from being posted.
- A way to report offensive content, and timely responses to those reports.
- A way to block abusive users.
- Published contact information, so people can easily reach you.
There’s also something new about the consequences: not putting these safeguards in place, or not fixing a problem after Apple flags it, may be treated as a violation of the Developer Code of Conduct, and egregious or repeated cases are removed from the App Store and the developer program.
If your app uses a model to generate images or text that users share, it falls under this guideline even if it isn’t a social network.
3.1.1(a): links to other purchase methods
This one is a change in structure. The Music Streaming Services Entitlement is no longer a separate bullet; it’s now part of the StoreKit External Purchase Link Entitlements bullet. The guideline also clarifies that the link has to go to a “permitted destination”, and that approved destinations may vary by region.
If you don’t link to purchases outside the app, it doesn’t affect you.
Section 5: removal and blocking
The introduction to the legal section now says that in extreme cases, such as apps that facilitate human trafficking or the exploitation of children, Apple will notify the authorities, remove the app from the App Store, and also block it from alternative distribution, meaning third-party stores where the law allows them.
The numbers Apple shared
Along with the changes, Apple shared two numbers from last year: it kept more than 150,000 apps with safety issues from reaching users and terminated more than 193,000 developer accounts for fraud and abuse.
Also: the license agreement
Three days earlier, on October 13, Apple also updated the Apple Developer Program License Agreement. The changes cover security requirements, Group Purchases, Volume Purchasing, tax reporting, and other new features. To accept it you need to sign in to your developer account; if you haven’t yet, it’s worth doing now.
What to check in your apps
- If you use creative assets: no prices, no awards you didn’t win, no claims you can’t back up (2.3.14).
- If you use remote config or feature flags: everything you turn on was in the build Apple reviewed (2.5.19).
- On your next submission: describe new features in detail in the Notes for Review (2.3.1(a)).
- If your users generate or share content, with or without AI: filtering, reporting, blocking, and published contact info (1.2).
- Accept the updated license agreement in your account.