# Guideline 5.1.1: data collection, sign-in and account deletion rejections

> Guideline 5.1.1 (Data Collection and Storage) rejects apps that lack a privacy policy link, collect data without clear consent or vague purpose strings, force a login or personal details the core feature does not need, or let people create an account without letting them delete it inside the app.

Uptika team · Published: 2026-11-05 · Last updated: 2026-11-05 · https://uptika.app/en/guides/guideline-5-1-1-data-collection

## What does Guideline 5.1.1 cover?

Guideline 5.1.1, Data Collection and Storage, has ten sub-points, and a rejection message names the one you broke. Key sentences, quoted from the App Review Guidelines (last updated October 16, 2026):

| Sub-point | Key sentence (quoted) | What it means in practice |
|---|---|---|
| (i) Privacy Policies | "All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner." | Two links: metadata and app. The policy covers collection, sharing, retention, deletion and revoking consent. |
| (ii) Permission | "Apps that collect user or usage data must secure user consent for the collection, even if such data is considered to be anonymous at the time of or immediately following collection." | Ask first, never tie paid features to consent, let people withdraw it. |
| (iii) Data Minimization | "Apps should only request access to data relevant to the core functionality of the app and should only collect and use data that is required to accomplish the relevant task." | Prefer the system picker or a share sheet to full Photos or Contacts access. |
| (iv) Access | "Apps must respect the user's permission settings and not attempt to manipulate, trick, or force people to consent to unnecessary data access." | If someone declines location, let them type an address. |
| (v) Account Sign-In | "If your app doesn't include significant account-based features, let people use it without a login. If your app supports account creation, you must also offer account deletion within the app." | Optional login where possible; in-app deletion always. |
| (vi) | "Developers that use their apps to surreptitiously discover passwords or other private data will be removed from the Apple Developer Program." | No hidden harvesting. |
| (vii) | "SafariViewController must be used to visibly present information to users; the controller may not be hidden or obscured by other views or layers." | No invisible web views for tracking. |
| (viii) | "Apps that compile personal information from any source that is not directly from the user or without the user's explicit consent, even public databases, are not permitted on the App Store or alternative distribution." | No people-search built from scraped or public data. |
| (ix) | "Apps that provide services in highly regulated fields (such as banking and financial services, healthcare, gambling, legal cannabis use, air travel and crypto exchanges) or that require sensitive user information should be submitted by a legal entity that provides the services, and not by an individual developer." | An individual account cannot ship these. |
| (x) | "Apps may request basic contact information (such as name and email address) so long as the request is optional for the user, features and services are not conditional on providing the information, and it complies with all other provisions of these guidelines, including limitations on collecting information from kids." | Name and email fields must be skippable. |

## What does 5.1.1(v) require for sign-in and account deletion?

5.1.1(v) sets two rules: do not force a login without a reason, and if people can create an account, they must be able to delete it in the app. Apps also "may not require users to enter personal information to function, except when directly relevant to the core functionality of the app or required by law". If your core function is not tied to a specific social network, you "must provide access without a login or via another mechanism".

Apple's [account deletion help article](https://developer.apple.com/help/app-review/guideline-reference/5-1-1-account-deletion) adds the detail reviewers check:

- Make deletion easy to find, typically in account settings.
- Offer to delete the whole account record and associated personal data. Only offering to deactivate or disable the account is insufficient.
- If deletion finishes on a website, link directly to that page.
- Outside highly regulated fields, do not require a phone call, email, chat support or other support flow.
- Reauthentication and a confirmation step are fine; making it "unnecessarily difficult" is not.
- Automatically created guest accounts need a deletion option too.
- Manual deletion that takes time is fine if you say how long and confirm when done.
- Delete user-generated content shared with others, such as photos, posts and reviews, unless a law requires keeping it, and tell people what you keep.
- Everyone gets deletion, regardless of location; complying with one regional law is not sufficient.
- With auto-renewable subscriptions, tell people billing continues through Apple and ask them to cancel first. You may schedule deletion for the subscription's end as long as an immediate option also exists.
- Apps using Sign in with Apple should revoke user tokens with the Sign in with Apple REST API.

## How do you write purpose strings that pass 5.1.1(ii)?

A purpose string is the sentence in the system permission dialog. 5.1.1(ii): "Ensure your purpose strings clearly and completely describe your use of the data." Apple's [purpose strings article](https://developer.apple.com/help/app-review/guideline-reference/5-1-1-purpose-strings) asks for one brief, complete, active sentence naming the specific feature, one string per protected resource, and no marketing copy. Its examples:

| Insufficient | Clear and specific |
|---|---|
| "To use location." | "The app uses location data to determine the recommended route to your destination and provide turn-by-turn directions." |
| "Your data will be used to provide a better experience." | "The app uses tracking data to deliver personalized advertising for products that are most relevant to you." |

Purpose strings must also be localized, and you are responsible for requests made by third-party SDKs; remove API references your app has no reason to use.

## Who must submit under 5.1.1(ix)?

A legal entity that provides the service, not an individual developer, for the regulated fields in the table and for apps that require sensitive user information. Apple's App Review page says partnership documentation or authorization goes in the Attachment section of App Store Connect, with descriptions or links in the Review Notes. Typical documents are a partnership with the licensed institution for financial apps or a license per storefront for gambling.

## How does Guideline 4.8 Login Services relate to 5.1.1?

They are often cited together. If a third-party or social login sets up the primary account, 4.8 requires an equivalent option from another login service that limits data to name and email address, lets people keep their email private, and does not collect interactions for advertising without consent. Exceptions include apps that use only your own account system, education or enterprise accounts, government or industry-backed electronic IDs, and clients for a specific third-party service.

## What is the fix checklist for a 5.1.1 rejection?

1. Read the sub-point in the message, (i) to (x), and fix that first.
2. Put the privacy policy link in App Store Connect and inside the app.
3. Ask for consent before collecting, and add a way to withdraw it.
4. Rewrite every purpose string as one specific sentence, in every language, including those triggered by SDKs.
5. Remove permissions and form fields the core feature does not need; make name and email optional.
6. Let people use the app without an account if accounts are not central to it.
7. Add in-app account deletion that removes the account and its data, with subscription guidance.
8. If you use a social login for the primary account, add an equivalent option that meets 4.8.
9. In a regulated field, submit from the providing company's account and attach the documents.
10. Explain the change in App Review notes: where deletion lives, which permissions you removed ([notes templates](https://uptika.app/en/guides/guideline-2-1-app-completeness)).

The Google Play side is in the [Data safety form guide](https://uptika.app/en/guides/google-play-data-safety-form), purchase rules in the [Guideline 3.1.1 guide](https://uptika.app/en/guides/guideline-3-1-1-in-app-purchase), the rest in the [rejection reasons hub](https://uptika.app/en/guides/app-store-rejection-reasons).

## Where Uptika fits

Uptika does not inspect your binary or privacy flows, and it does not resolve rejections; it covers the listing text that goes to review with them. The free [Metadata Linter](https://uptika.app/en/tools/metadata-linter) checks your store text in the browser for limits and policy risks, and the panel's **Sayfa denetimi** (page audit) runs the same rejection-risk check on your live listing. When a fixed version is live, **Kelime radarı** (keyword radar) shows whether your daily ranks recovered in each storefront. Start on the [free plan](https://uptika.app/app/#/?signup=1).

## Questions

### What is Guideline 5.1.1(v) account sign-in?

5.1.1(v) says: if your app doesn't include significant account-based features, let people use it without a login. If the app supports account creation, it must also offer account deletion within the app, and it may not require personal information unless that is directly relevant to the core functionality or required by law.

### How do I fix a Guideline 5.1.1 data collection rejection?

Read which sub-point the message cites. Then add or fix the privacy policy link in App Store Connect and in the app, rewrite vague purpose strings, remove permissions and fields the core feature does not need, make sign-in optional where it can be, and add in-app account deletion.

### Do I need in-app account deletion?

Yes, if the app supports account creation, including automatically created guest accounts. Deactivating an account is not enough, and outside highly regulated fields you should not send people to a phone call, email or support chat to finish it. A link to a web page that completes deletion is allowed.

### What is Guideline 5.1.1(ix)?

Apps in highly regulated fields, such as banking and financial services, healthcare, gambling, legal cannabis use, air travel and crypto exchanges, or that require sensitive user information, should be submitted by a legal entity that provides the services, not by an individual developer.

### Is account deletion required only where privacy laws demand it?

No. Apple's help article says everyone should be able to delete their account regardless of where they are located. A flow you built for one law can be offered to everyone if it meets 5.1.1(v).

## Sources

- [App Review Guidelines 5.1.1 Data Collection and Storage (Apple Developer)](https://developer.apple.com/app-store/review/guidelines/#data-collection-and-storage)
- [App Review Guidelines 5.1.1(v) Account Sign-In (Apple Developer)](https://developer.apple.com/app-store/review/guidelines/#5.1.1v)
- [App Review Guidelines 4.8 Login Services (Apple Developer)](https://developer.apple.com/app-store/review/guidelines/#login-services)
- [5.1.1(v) Offering account deletion in your app (App Review Help)](https://developer.apple.com/help/app-review/guideline-reference/5-1-1-account-deletion)
- [5.1.1(ii) Write clear purpose strings (App Review Help)](https://developer.apple.com/help/app-review/guideline-reference/5-1-1-purpose-strings)
- [App Review (Apple Developer)](https://developer.apple.com/distribute/app-review/)
- [Provide information for a complete review (App Review Help)](https://developer.apple.com/help/app-review/before-submitting-for-review/complete-review)

## Free tools

- [Metadata Linter](https://uptika.app/en/tools/metadata-linter): Paste your store text: limits, repeats, singular/plural waste and policy risks, instantly, in your browser.

---

Uptika is an ASO and store-intelligence tool for the App Store and Google Play. https://uptika.app/en