Following an announcement to developers through App Store Connect last night, Apple now requires all new apps and updates to include a link to their developer’s privacy policy in the app metadata. The new rules will come into effect from October 3rd.
Even if the app is a basic utility application that doesn’t connect to the internet, it must still host a website with a privacy policy page.
The App Store app listings have had a privacy policy URL metadata field for a long time. They have been mandatory for apps that have subscriptions, but this rule now applies to all apps in the store. Apple will not pull existing apps from sale, but any future update must ensure it has the privacy policy URL set.
On iPhone or iPad, customers will be able to tap on the link to the privacy policy and read it in Safari. tvOS does not have a web browser, so developers will have to copy and paste their privacy into a text box when they submit their apps, so the Apple TV can display it.
Apple says “The privacy policies must identify what data the app collects, in what manner, and how it is used. It is also the responsibility of the app developer to confirm that the behavior of any embedded third-party frameworks complies with the parent app’s privacy policy. Apple also says that apps must clearly explain data retention policies and detail how a user can revoke consent and request deletion of any personal data stored.”
It remains to be seen whether Apple will pull apps that are found to be in violation of their privacy policies. Data-sharing practices in ‘apps’ has come under scrutiny in recent months, in the wake of scandals like Cambridge Analytica.
Apple instated informational onboarding screens that describe how it uses personal data earlier this year, as part of European GDPR regulation. The new App Store requirements are likely related to GDPR compliance at some level.
A privacy policy is required for App Store distribution, as well as external TestFlight beta testing stages. To read the full story visit the Apple blog page.