# Apple App Store compliance requirements for a social / user-generated-content platform

Author: retoor <retoor@molodetz.nl>

This document is the research artefact for stage one of `apple.md`. It records **what Apple requires**, not what DevPlace currently does. The gap analysis is `applechanges.md`; the implementation design is `appleimpl.md`.

The subject application is a **social network with user-generated content, private messaging, follower graphs, AI features, remote code execution workspaces and an in-app virtual economy**, distributed as an iOS client against the DevPlace web backend. Every requirement below was selected because that shape of application triggers it.

Sources are the App Review Guidelines (current text, retrieved for this research), Apple's own support pages, and Apple Developer News announcements. Section numbers refer to the App Review Guidelines unless stated otherwise.

---

## 0. The governing principle

Apple treats the **backend** as part of the app. Guideline 4.7.1 and 1.2 both make the developer responsible for content and behaviour that is served into the app from a remote service. A rejection under 1.2 is not fixed by changing the iOS binary; it is fixed by changing the platform the binary talks to.

Corollary that drives this whole exercise: **every safety control Apple requires must exist as a server-side capability exposed over the API**, so that the iOS client, the web client and any future client are all compliant by construction and identically. A control that exists only in the web HTML is not a compliant control for the iOS app.

---

## 1. Safety

### 1.1 Objectionable content

Apps must not include content that is offensive, insensitive, upsetting, intended to disgust, in exceptionally poor taste, or just plain creepy. The enumerated categories:

| Ref | Prohibited content |
|-----|--------------------|
| 1.1.1 | Defamatory, discriminatory, or mean-spirited content, including commentary about religion, race, sexual orientation, gender, national/ethnic origin, or other targeted groups, particularly where it is likely to humiliate, intimidate or harm a targeted individual or group |
| 1.1.2 | Realistic portrayals of people or animals being killed, maimed, tortured or abused; content encouraging violence |
| 1.1.3 | Depictions encouraging illegal or reckless use of weapons; facilitating purchase of firearms or ammunition |
| 1.1.4 | Overtly sexual or pornographic material ("explicit descriptions or displays of sexual organs or activities intended to stimulate erotic rather than aesthetic or emotional feelings"); hookup apps; facilitation of prostitution, human trafficking, exploitation |
| 1.1.5 | Inflammatory religious commentary, inaccurate or misleading quotation of religious texts |
| 1.1.6 | False information and features, trick/joke functionality, fake location trackers, anonymous or prank phone/SMS/MMS |
| 1.1.7 | Harmful concepts capitalising on recent or current events (violent conflict, terrorist attacks, epidemics) |

For a UGC platform this is not a content-authoring rule, it is a **moderation obligation**: the platform must be capable of preventing this material from being posted and of removing it once present.

### 1.2 User-generated content - the central requirement

Verbatim, the four mandatory mechanisms:

> Apps with user-generated content or social networking services must include:
> - A method for filtering objectionable material from being posted to the app
> - A mechanism to report offensive content and timely responses to concerns
> - The ability to block abusive users from the service
> - Published contact information so users can easily reach you

Additional obligations stated in the same guideline:

- It is the developer's responsibility to remove content that violates the guideline, **the developer's own terms of service, or the developer's community standards**. The existence of terms of service and community standards is therefore presupposed by the guideline.
- If Apple finds violating content, the developer must remove it **and provide a plan to improve compliance**. The app may be pulled until improvements are demonstrated.
- Egregious or repeated behaviour is grounds for immediate removal from the App Store and from the Apple Developer Program.
- Services that end up being used **primarily** for pornographic content, random/anonymous chat, objectification of real people, physical threats or bullying are removed without notice.
- Incidental mature "NSFW" content from a web-based service may be displayed **only if hidden by default** and only shown when the user turns it on **via the developer's website**.

**Review practice (the part not written in the guideline).** The standard 1.2 rejection letter and the consistently reported remediation set requires all five of:

1. **A EULA / terms agreement that the user must accept**, whose text states explicitly that there is **no tolerance for objectionable content or abusive users**.
2. **A filtering method** applied to content before or as it is published.
3. **A flag/report mechanism** on every piece of user-generated content.
4. **A block mechanism** for abusive users.
5. **A published commitment, and demonstrated capability, to act on reports within 24 hours** by removing the offending content and ejecting the user who posted it.

Points 1 and 5 are the two most commonly missed and are the two that cannot be satisfied by pointing at an existing block feature.

Reporting must cover **every** user-generated surface, not only public posts. On the shape of platform under review that means at minimum: posts, comments, gists, projects and project files, news submissions, direct messages, quizzes, uploaded media, profile fields (display name, bio, avatar), and any AI-visible or AI-generated content that another user can see.

### 1.2.1 Creator content

Where a platform features content from a community of "creators" who author, share and monetize experiences inside the app, that content is treated as UGC by App Review and must follow 1.2 and 3.1.1.

> **(a)** Creator apps must provide a way for users to identify content that exceeds the app's age rating, and use an age restriction mechanism based on **verified or declared age** to limit access by underage users.

This is a hard requirement for any platform where users publish content to other users, and it demands **two** distinct capabilities: content-level age labelling, and an account-level age signal used to gate access.

### 1.3 Kids Category

Not applicable unless the app opts into the Kids Category, which a developer social network must not. The relevant knock-on is 2.3.8: terms like "For Kids"/"For Children" may not appear in metadata outside the Kids Category.

### 1.4 Physical harm

1.4.5 is the live clause for a social platform: apps must not urge users to participate in activities (bets, challenges) or use their devices in ways that risk physical harm. Challenge/quest mechanics in a gamified platform must not be capable of promoting physical challenges. 1.4.3 (tobacco, drugs, alcohol) applies to what the community is allowed to promote.

### 1.5 Developer information

> People need to know how to reach you with questions and support issues. Make sure **your app and its Support URL** include an easy way to contact you.

"Your app" is explicit: an external support URL alone is insufficient. Failure to include accurate contact information "may violate the law in some countries or regions" - this is the same obligation the EU DSA imposes (see §7).

### 1.6 Data security

Appropriate security measures to ensure proper handling of user information and to prevent unauthorised use, disclosure or access by third parties.

### 1.7 Reporting criminal activity

Apps for reporting alleged criminal activity must involve local law enforcement. Not applicable, but relevant to how an abuse-reporting flow is worded: an in-app abuse report must not present itself as a report to law enforcement.

---

## 2. Performance

### 2.1 App completeness

Submissions must be final, fully functional, with working URLs and no placeholder text. **Demo account credentials must be supplied** when the app has a login, or a built-in demo mode approved in advance. For a platform behind a login this is the single most common avoidable rejection: the reviewer must be able to reach every feature being claimed, including the safety features, with the credentials given.

The reviewer will attempt to exercise the reporting and blocking flow. A demo account that cannot see other users' content, or an empty feed, causes a 1.2 rejection because the reviewer cannot verify the mechanism exists.

### 2.3 Accurate metadata

- **2.3.1** No hidden, dormant or undocumented features. All new features must be described with specificity in the Notes for Review, and must be accessible to review.
- **2.3.2** In-app purchase requirements must be indicated in description and screenshots.
- **2.3.6** The age rating questionnaire must be answered honestly. A mis-rated app "could trigger an inquiry from government regulators".
- **2.3.7** App name ≤ 30 characters; no keyword stuffing.
- **2.3.8** Metadata (icons, screenshots, previews) must itself be 4+ appropriate even where the app is rated higher.
- **2.3.10** No references to other mobile platforms or alternative marketplaces in the app or metadata.
- **2.3.12** "What's New" must describe significant changes specifically.

### 2.5 Software requirements - the clauses that matter for a developer platform

- **2.5.1** Public APIs only; app must run on the currently shipping OS.
- **2.5.2** *Load-bearing for any coding platform.* Apps "may not download, install, or execute code which introduces or changes features or functionality of the app, including other apps." The **educational exception**: "Educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes. **Such apps must make the source code provided by the app completely viewable and editable by the user.**"
  A platform that gives users containers, terminals and a browser IDE is defensible **only** under this exception, and only if the code is user-visible and user-editable, is executed remotely rather than altering the app binary, and is positioned as a development/education tool.
- **2.5.4** Background services only for their intended purposes.
- **2.5.5** Must be fully functional on **IPv6-only networks**. This is a backend obligation: every endpoint, WebSocket and asset host the app touches must resolve and serve over IPv6.
- **2.5.6** Web browsing must use WebKit. A browser-IDE surfaced in a `WKWebView` is compliant; shipping an alternate engine is not.
- **2.5.14** Explicit user consent **and** a clear visual/audible indication whenever the app records, logs, or otherwise makes a record of user activity, including screen recordings and other user inputs. Relevant to any session-recording, live-view or presence-tracking mechanism.
- **2.5.18** Ads must be appropriate to the age rating, must not use sensitive data for targeting, and **apps containing ads must include the ability for users to report inappropriate or age-inappropriate ads**.

---

## 3. Business

### 3.1.1 In-app purchase

If the app unlocks features, functionality, subscriptions, in-app currency, levels or premium content, **it must use in-app purchase**. Own mechanisms - license keys, QR codes, cryptocurrency - are prohibited.

Consequences for a gamified social platform:

- Virtual currency that is **only earnable through play and never purchasable for real money** is outside 3.1.1 entirely. This is the safe position.
- Purchased credits and in-game currencies **may not expire** and require a restore mechanism.
- Randomized virtual items ("loot boxes") must **disclose the odds** of each item type before purchase.
- Tipping another user's content, "boosts" of posts, and any digital good consumed in the app must use IAP (3.2.1(vii) and 3.1.3(g) read together: person-to-person monetary gifts are exempt only when entirely optional and 100 % passes to the receiver and is not connected to receiving digital content or services).
- AI credit top-ups, quota increases, or paid model access sold to the end user inside the app are digital services and require IAP.

### 3.1.1(a) / 3.1.3 external purchase

Outside the United States storefront, apps may not include buttons, external links or other calls to action directing customers to purchasing mechanisms other than IAP, absent the relevant StoreKit External Purchase Link Entitlement. A web platform that sells anything on its website must be careful that the iOS client does not link to that purchase path.

### 3.2.2 Unacceptable

- **(x)** Apps must not force users to rate, review, or download other apps to access functionality.
- **(v)** No arbitrary restriction of who may use the app by location or carrier.
- **(vii)** No artificial manipulation of a user's visibility, status or rank on other services.

---

## 4. Design

### 4.2 Minimum functionality

The app must be more than a repackaged website. A thin `WKWebView` wrapper around the existing web front end is a 4.2 rejection. The client needs native navigation, native affordances, push notifications, offline or cached state, and platform integration that a browser tab does not have.

**4.2.3(i)** the app must work on its own without requiring installation of another app. **4.2.2** apps must not primarily be web clippings or collections of links.

### 4.7 Mini apps, mini games, chatbots, plug-ins

This section is directly engaged by two features of the platform under review: an **in-app AI chatbot** and **user-authored software/experiences that other users can open**.

> Apps may offer certain software that is not embedded in the binary, specifically HTML5 and JavaScript mini apps and mini games, streaming games, **chatbots**, and plug-ins. […] **You are responsible for all such software offered in your app**, including ensuring that such software complies with these Guidelines and all applicable laws.

**4.7.1** Software offered under this rule must:
- follow all privacy guidelines, including guideline 5.1 on collection, use and sharing of data and sensitive data;
- **include a method for filtering objectionable material, a mechanism to report content and timely responses to concerns, and the ability to block abusive users**; and
- follow guideline 3.1 to offer digital goods or services.

**4.7.2** The app may not extend or expose native platform APIs to that software without prior permission.
**4.7.3** The app may not share data or privacy permissions to any individual software offered in the app **without explicit user consent in each instance**.
**4.7.4** The developer must provide **an index of software and metadata available in the app, including universal links** that lead to all software offered.
**4.7.5** The app must provide a way for users to **identify software that exceeds the app's age rating**, and use an **age restriction mechanism based on verified or declared age** to limit access by underage users.

Note that 4.7.1 restates the 1.2 quartet - filtering, reporting, timely response, blocking - and applies it to **chatbot output** as well as user content. An AI assistant that can emit objectionable text is subject to the same reporting and filtering obligation as a user post.

### 4.8 Login services

Applies only if the app uses a **third-party or social login service** to establish the user's primary account. An app that exclusively uses its own account setup and sign-in system is explicitly exempt and is **not** required to offer Sign in with Apple. Adding "Log in with GitHub" or any similar social provider immediately creates the obligation to also offer an equivalent privacy-preserving login (Sign in with Apple being the canonical one), with the three properties: name+email only, private-email option, no advertising-purpose interaction collection.

### 4.5.4 Push notifications

- Push must **not be required** for the app to function.
- Must not carry sensitive or confidential information.
- Must not be used for promotions or direct marketing **unless the customer has explicitly opted in via consent language displayed in the app's UI**, and the app **provides an in-app method to opt out**.

### 4.10 Monetizing built-in capabilities

Push Notifications, camera, gyroscope, iCloud storage and similar OS capabilities may not be monetized.

---

## 5. Legal

### 5.1.1(i) Privacy policy

> All apps must include a link to their privacy policy **in the App Store Connect metadata field and within the app in an easily accessible manner**.

The policy must clearly and explicitly:
- identify what data the app/service collects, how it collects it, and **all** uses of that data;
- confirm that any third party with whom the app shares user data - analytics, ad networks, third-party SDKs, parents, subsidiaries or related entities - provides the same or equal protection of user data;
- explain data retention/deletion policies and **describe how a user can revoke consent and/or request deletion of the user's data**.

Two distinct deliverables: an in-app accessible link, and a policy whose content covers those three points.

### 5.1.1(ii) Permission and consent withdrawal

Consent must be secured for collection of user or usage data even where anonymous. Paid functionality must not depend on granting data access. The app must provide **an easily accessible and understandable way to withdraw consent**.

### 5.1.1(iii) Data minimization

Only request access to data relevant to core functionality.

### 5.1.1(v) Account sign-in and **account deletion**

> If your app supports account creation, you must also **offer account deletion within the app**.

From Apple's dedicated support page, in force since **30 June 2022**:

- The app must **offer to delete the entire account record along with associated personal data**. Offering only to temporarily deactivate or disable an account is **explicitly insufficient**.
- The account deletion option must be **easy to find**, typically in account settings.
- If completion requires a website, the app must link **directly to the page** where the process is completed - not to a general support page and not merely out to the default browser.
- If deletion takes additional time, the user must be told.
- Confirmation steps are permitted: reauthentication, identity verification, entering a code sent to an address already on the account.
- Support-flow-only deletion (phone call, email, ticket) is permitted **only** for highly regulated industries under 5.1.1(ix). A social network is not one.
- Apps that make deletion "unnecessarily difficult" fail review.

Also in 5.1.1(v): if the app does not include significant account-based features, people must be able to use it without a login. A social network is account-based by nature, but **read-only public browsing without an account** is a strong signal of good faith and reduces friction with this clause and with 4.2.

### 5.1.1(x) Optional contact information

Basic contact information may be requested only if optional, with features not conditional on providing it.

### 5.1.2 Data use and sharing - the AI clause

> You must clearly disclose where personal data will be shared with third parties, **including with third-party AI**, and obtain **explicit permission** before doing so.

This is decisive for any platform that routes user content through an external model provider. Every path where a user's post, comment, message, file, or profile text leaves the platform for a third-party model is a third-party data share that requires **disclosure plus explicit permission**, not merely a line in a privacy policy.

Further clauses:
- **(i)** The app may not require the user to enable push notifications, location or tracking in order to access functionality or receive compensation. App Tracking Transparency consent is required for tracking.
- **(ii)** Data collected for one purpose may not be repurposed without further consent.
- **(iii)** No surreptitious profile building; no attempts to re-identify anonymous or aggregated data.

### 5.1.4 Kids

Apps that collect, transmit or have the capability to share personal information from a minor - including "the ability to chat" and persistent identifiers - must include a privacy policy and comply with all applicable children's privacy statutes (COPPA, GDPR and equivalents). Birthdate and parental contact information may be requested **only** for the purpose of complying with those statutes.

### 5.2 Intellectual property

- **5.2.1** No protected third-party material without permission; no misleading or copycat names or metadata.
- **5.2.2** Content from a third-party service requires permission under that service's terms; authorization must be provided on request. Engaged by any news/RSS ingestion feature.
- **5.2.3** No saving, converting or downloading media from third-party sources without explicit authorization. Engaged by any URL-fetch, archive, or media-embed feature.
- **5.2.5** No Apple emoji embedded in the binary; no interfaces confusingly similar to Apple products.

A UGC platform additionally needs a **notice-and-takedown (DMCA-style) path**, because 5.2 makes the developer answerable for infringing user content and 1.2 makes removal the developer's responsibility.

### 5.3 Gaming, gambling, lotteries

If the platform runs contests, sweepstakes or prize draws: the developer must sponsor them, **official rules must be presented in the app**, and the rules must state that **Apple is not a sponsor and is not involved in any manner**. Randomized reward mechanics that cannot be purchased with real money stay outside 5.3.4.

### 5.6 Developer code of conduct

Trust (5.6.1), ratings and reviews integrity (5.6.2), accurate developer identity (5.6.3) and the prohibition on predatory behaviour (5.6.4) - the latter explicitly covering exploitation of minors and facilitation or encouragement of harmful behaviour toward others. Violations can remove the developer from the Apple Developer Program entirely, independent of any single app.

---

## 6. App Store Connect obligations (metadata, not code)

These are not guideline sections but they block submission or removal just as hard.

### 6.1 Age rating - the 2025 overhaul

Apple replaced the old ladder with **4+, 9+, 13+, 16+, 18+**; the 12+ and 17+ tiers were removed. The questionnaire gained required questions covering in-app controls, capabilities, medical/wellness topics, and violent themes, plus a **social-features block** covering:

- user-generated content;
- messaging capability;
- friend or follower systems;
- livestreaming;
- content creation tools;
- advertising that may expose users to age-sensitive material.

Apple additionally asks **what safeguards the developer has implemented**: moderation systems, content filtering, reporting tools, blocking functionality, parental controls. Answering "none" to those questions on a social app drives the rating up and invites 1.2 scrutiny; answering "yes" untruthfully violates 2.3.6.

Developers were required to complete the updated questionnaire by **31 January 2026**, after which app updates are blocked in App Store Connect until the new questions are answered.

**Consequence for this project:** the safeguards questionnaire is answered from the platform's actual feature set. Each of the five safeguard answers should map to a named, demonstrable feature.

### 6.2 App privacy details ("nutrition labels")

Every data type collected by the app **or by its third-party partners** must be declared across the categories: Contact Info, Health & Fitness, Financial Info, Location, Sensitive Info, Contacts, User Content, Browsing History, Identifiers, Purchases, Usage Data, Diagnostics, Surroundings. Each declared type is classified as **Used to Track You**, **Linked to You**, or **Not Linked to You**. The developer is responsible for third-party SDK collection and for **keeping the answers accurate and up to date**; answers may be changed at any time without an app update.

For the platform under review the realistic declaration set is: Contact Info (name, email), User Content (posts, messages, photos/videos, other user content), Identifiers (user ID), Usage Data (product interaction), Diagnostics, and - if any analytics or crash reporting is added - the corresponding categories. All "Linked to You"; none "Used to Track You" provided no cross-app advertising tracking exists.

### 6.3 Support URL, marketing URL, privacy policy URL

Required metadata. The Support URL must present a working contact route (1.5). The privacy policy URL must be live and must match the in-app policy.

### 6.4 EU Digital Services Act trader status

Since **17 February 2025**, apps without a declared and verified trader status are **removed from the App Store in the EU**. Trader status became required for update submission on 16 October 2024. Articles 30 and 31 DSA require Apple to verify and publish trader contact information - **address, phone number and email** - on the App Store product page. The DSA definition of commercial activity is broad: paid apps, apps with IAP, or otherwise commercial distribution.

### 6.5 Notes for Review

Under 2.3.1 all functionality must be described specifically. For an app of this shape the notes must at minimum describe: the moderation pipeline, where the report and block controls are, where account deletion is, that code execution is remote and user-owned under the 2.5.2 educational exception, that the AI assistant is a chatbot under 4.7 with its own safety controls, and the demo account credentials with pre-seeded content so the reviewer can exercise reporting.

---

## 7. Overlapping legal regimes Apple enforces by reference

| Regime | What Apple enforces | Practical requirement |
|--------|---------------------|-----------------------|
| **GDPR** (5.1.1(ii), 5.1.2) | Lawful basis, consent, withdrawal, erasure | Consent capture with timestamp and version; consent withdrawal UI; account + data deletion; data export is the companion right users will ask for |
| **EU DSA** (6.4, 1.5) | Trader identity, published contact, notice-and-action | Published contact information in app and on the store page; a reporting mechanism with acknowledgement and outcome notice; a statement of reasons to the affected user when content is removed |
| **COPPA** (5.1.4) | No collection from under-13s without verifiable parental consent | Declared-age gate at signup; block or restrict accounts below the platform's minimum age; do not collect birthdate for any other purpose |
| **DMCA / copyright** (5.2) | Removal of infringing user content | A designated notice-and-takedown channel and a counter-notice path |
| **Local content ratings** (2.3.6) | Territory-specific rating and warning display | Age labelling on content that exceeds the app rating (also required by 1.2.1(a) and 4.7.5) |

---

## 8. The complete requirement register

Every row is a discrete, testable obligation. This register is the input to `applechanges.md`.

### 8.1 Mandatory - a missing item is a certain rejection

| # | Requirement | Source |
|---|-------------|--------|
| R1 | Terms of service / EULA that **explicitly states zero tolerance for objectionable content and abusive users** | 1.2 (review practice) |
| R2 | **Affirmative acceptance** of those terms recorded per user at account creation, and re-acceptance on material change | 1.2, GDPR |
| R3 | **Community guidelines** enumerating prohibited content, aligned to the 1.1.1-1.1.7 categories | 1.1, 1.2 |
| R4 | **Automated filtering** of objectionable material at the point of posting, on every UGC surface | 1.2, 4.7.1 |
| R5 | **Report mechanism on every UGC surface**: posts, comments, gists, projects, files, media, news, DMs, quizzes, profiles, AI output, workspaces | 1.2, 4.7.1 |
| R6 | **Moderation queue** with triage, decision and enforcement actions for the operators | 1.2 |
| R7 | **Published 24-hour response commitment** and a mechanism that makes it achievable and evidenced | 1.2 (review practice) |
| R8 | **Ejection of offending users** - suspension/ban as a first-class enforcement action, not only content deletion | 1.2 |
| R9 | **Block abusive users** from the service, covering all interaction surfaces including DMs | 1.2 |
| R10 | **Published contact information reachable inside the app** | 1.5, DSA Art. 30 |
| R11 | **Privacy policy** meeting 5.1.1(i)'s three content requirements, linked in-app and in ASC metadata | 5.1.1(i) |
| R12 | **In-app account deletion** that deletes the account record and associated personal data, easy to find, no support-flow requirement | 5.1.1(v) |
| R13 | **Declared-age gate** at account creation, with a minimum age, plus an age-restriction mechanism limiting underage access to age-exceeding content | 1.2.1(a), 4.7.5, 5.1.4 |
| R14 | **Content age labelling** so users can identify content exceeding the app's age rating; mature content **hidden by default** | 1.2, 1.2.1(a), 4.7.5 |
| R15 | **Explicit consent before user content is sent to third-party AI**, plus disclosure of which provider and what data | 5.1.2(i) |
| R16 | **Consent withdrawal** UI that is easily accessible and understandable | 5.1.1(ii) |
| R17 | **Push notifications optional**, never required for function, marketing push opt-in with in-app opt-out | 4.5.4, 5.1.2(i) |
| R18 | **DMCA / IP notice-and-takedown** channel | 5.2 |
| R19 | **Demo account with pre-seeded content** and review notes describing every safety control's location | 2.1, 2.3.1 |
| R20 | **Age rating questionnaire** answered from the real feature set, including the five safeguard answers | 2.3.6, 6.1 |
| R21 | **App privacy details** declared accurately for every data type, including third-party AI processing | 6.2 |
| R22 | **EU trader status** declared and verified, with address, phone and email | 6.4 |
| R23 | **IPv6-only reachability** of every endpoint, WebSocket and asset host | 2.5.5 |
| R24 | **Remote code execution positioned under the 2.5.2 educational exception**: source completely viewable and editable, executed off-device, never altering the app | 2.5.2 |
| R25 | **Native client that is materially more than a web wrapper** | 4.2 |

### 8.2 Conditional - required if the corresponding feature exists

| # | Requirement | Trigger |
|---|-------------|---------|
| C1 | Sign in with Apple or an equivalent privacy-preserving login | Any third-party/social login is offered |
| C2 | In-app purchase for every digital good, currency, credit, boost, tip or premium unlock | Anything is sold to end users in-app |
| C3 | Loot-box odds disclosure | Randomized purchasable rewards |
| C4 | Official contest rules in-app stating Apple is not a sponsor | Any sweepstake, contest or raffle |
| C5 | Index of all offered mini apps/software with universal links | Users can open other users' software from the app |
| C6 | Ad reporting control | Advertising is displayed |
| C7 | ATT prompt | Any cross-app/site tracking |
| C8 | Recording indicator and consent | Any session/screen/activity recording |
| C9 | Per-instance consent before sharing data or permissions with a mini app | Mini apps receive user data |

### 8.3 Posture requirements - not a single feature, an ongoing obligation

| # | Requirement | Source |
|---|-------------|--------|
| P1 | Ability to produce, on Apple's request, a **compliance improvement plan** and evidence of moderation throughput | 1.2 |
| P2 | Retention of moderation decisions as an audit trail | 1.2, DSA |
| P3 | Statement of reasons to the user whose content is removed or whose account is actioned | DSA Art. 17 |
| P4 | Keeping privacy labels and the privacy policy in step with feature changes | 6.2, 5.1.1(i) |
| P5 | Accurate "What's New" text for significant changes | 2.3.12 |

---

## 9. Where reviewers actually look

Ordered by observed rejection frequency for this application shape:

1. **Report control not visible on the first screen of content the reviewer opens.** The reviewer opens the feed, taps a post, and looks for a report affordance. If it is buried behind a profile menu, the app is rejected under 1.2 even though the mechanism exists.
2. **No terms acceptance at signup.** The reviewer creates an account with the demo credentials or a fresh account and looks for the EULA gate.
3. **Account deletion not found in settings.** The reviewer opens account settings and searches for "Delete account".
4. **Privacy policy not reachable in-app.**
5. **Demo account sees an empty feed**, so nothing can be reported or blocked.
6. **Blocking present but not reachable from the content itself**, only from a profile.
7. **AI feature sending content to a third party with no disclosure or consent.**
8. **No age gate on a platform with messaging and follower systems.**

---

## 10. Determination for this platform

Applying the register to the DevPlace shape:

- **Applicable in full:** R1-R25 except where noted below.
- **C1 not triggered** provided the platform continues to use exclusively its own account system. Adding any social login triggers it immediately.
- **C2 not triggered** provided no in-app purchase of any digital good, currency, credit or quota exists and none is linked to. The in-app virtual economy must remain earn-only.
- **C3 not triggered** while randomized rewards are not purchasable.
- **C4 triggered** by any leaderboard prize, era award or contest that awards something of value; the safe position is that awards are purely cosmetic/status and are not framed as a contest with prizes.
- **C5 triggered** if a user can open another user's running workspace, published site or executable project from the app.
- **C6, C7 not triggered** while there is no advertising and no cross-app tracking.
- **C8 triggered** by presence tracking, live view relay, session recording or terminal session capture that records user activity.
- **C9 triggered** by any path where platform user data is passed into a user-authored workspace or plug-in.

The single largest exposure is **R5 breadth**: reporting must exist on every surface, and the platform under review has an unusually large number of distinct UGC surfaces. The second largest is **R15**, because AI is woven through the platform and every path that sends user text to a model provider is a third-party data share.

---

## Sources

- [App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/)
- [Offering Account Deletion in Your App](https://developer.apple.com/support/offering-account-deletion-in-your-app/)
- [App Privacy Details on the App Store](https://developer.apple.com/app-store/app-privacy-details/)
- [Updated age ratings in App Store Connect](https://developer.apple.com/news/?id=ks775ehf)
- [Age rating questionnaire now includes social media questions](https://developer.apple.com/news/?id=tlur8uvi)
- [Apple overhauls App Store age ratings](https://www.macrumors.com/2025/07/25/apple-overhauls-app-store-age-ratings/)
- [Apple notifies developers of new App Store age rating system](https://9to5mac.com/2025/07/24/apple-notifies-developers-of-new-app-store-age-rating-system/)
- [Apps without trader status will be removed from the App Store in the EU](https://developer.apple.com/news/?id=einwn76m)
- [Manage European Union Digital Services Act trader requirements](https://developer.apple.com/help/app-store-connect/manage-compliance-information/manage-european-union-digital-services-act-trader-requirements/)
- [Provide your trader status in App Store Connect](https://developer.apple.com/news/?id=x60uzbu9)
- [Resolving App Store Guideline 1.2 - User Generated Content](https://buddyboss.com/docs/app-store-guideline-1-2-safety-user-generated-content/)
- [Complying with Apple App Store UGC requirements](https://www.termsfeed.com/videos/apple-app-store-comply-ugc-requirements/)
- [Guideline 1.2 - Safety - User-Generated Content (Apple Developer Forums)](https://developer.apple.com/forums/thread/807358)