App Store AI Rejection: Guideline 5.1.2 Fix

App Review rejected your app under "Guideline 5.1.2 - Legal - Privacy - Data Use and Sharing" because it sends user content to a third-party AI service — OpenAI, Anthropic, Google Gemini, ElevenLabs, or similar — without naming that provider and getting explicit consent first. This is now one of the most common rejections for any app with a chat, summarize, transcribe, or "magic" feature. The fix is a specific in-app consent screen plus matching privacy policy and App Privacy label entries → privacy policy page generator.

This article is practical guidance for developers, not legal advice.

What changed

In the November 13, 2025 App Review Guidelines update, Apple added third-party AI to Guideline 5.1.2(i). The clause now reads that you "must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so" (developer.apple.com/news, guidelines 5.1.2). It was the first time Apple named third-party AI as its own regulated category. Enforcement has been steady through 2026, and Apple's June 2026 guidelines revision tightened surrounding areas (spam, app quality, identity), so reviewers are scrutinizing AI apps more, not less. Relying on a line buried in your privacy policy is explicitly not enough; the disclosure has to be a visible in-app interaction before the data leaves the device.

On-device vs server: where the rule bites

The trigger is personal data leaving the device, not the use of AI itself.

On-device models (Core ML, Apple's on-device foundation models, a bundled local model) that never transmit user content do not require a 5.1.2(i) consent prompt for third-party sharing, because nothing is shared.
Server models — any call to a cloud API where user text, images, audio, documents, or metadata are transmitted to a company other than you — require disclosure and explicit opt-in first. This is true even if you strip names, even if the provider says it does not retain data, and even if you call it through your own backend that then forwards to the model host. If the user's content reaches OpenAI or Anthropic, the user has to know and agree.

The four things your consent flow must do

Reviewers reject generic disclosures. To pass, the consent screen shown before the first request must:

Name the specific provider. "Powered by AI" or "our AI partners" fails. "We use OpenAI" or "processed by Anthropic" passes. If you may switch providers, name all of them.
State the purpose in plain language. "The text you enter is sent to OpenAI to generate a reply" passes. "To enhance your experience" fails.
Say exactly what data is sent. "The message you type and the last 10 messages in this conversation" passes. "Some usage data" fails. Call out sensitive inputs (photos, health notes, voice recordings, location) explicitly.
Require an explicit opt-in before the first call. A distinct "Allow" or "Continue" tap. Consent inferred from continued app use, or a screen that appears after the first API call already fired, both fail.

Also give users a way to withdraw consent later (a toggle in Settings) and, ideally, disclose whether the provider uses the data to train models and how to opt out. For the major providers, business and API tiers generally do not train on submitted data by default — state which tier you use.

What to put in the privacy policy

The policy must name each AI subprocessor, the data categories sent, the purpose, the retention position, the training position, and a link to that provider's own policy and data-processing terms. It has to agree with your consent screen and your App Privacy label — reviewers cross-check all three. Our clause library has vendor-specific language you can reuse: SDK privacy policy clauses. Generate a hosted policy that includes your AI processors here: /privacy-policy-page-generator.

What to put in the App Privacy label

In App Store Connect > App Privacy, the content users send to the AI provider is usually "User Content," and it is typically Data Linked to You if it travels with an account or device identifier. Because a third party receives it, disclose it as collected by a third-party partner. If the AI provider or your pipeline uses the data for cross-app advertising or shares it with a data broker, that becomes "Data Used to Track You" and requires an App Tracking Transparency prompt too (developer.apple.com/app-store/app-privacy-details). Keep the label current: you can update answers without shipping a build, and a label that contradicts the policy is itself a 5.1.1 rejection.

Common rejection language

Typical Resolution Center wording for this issue:

"The app sends personal data to a third-party AI service, but the app does not clearly identify the third party or obtain the user's explicit consent before the data is shared."
"Your app's disclosure references AI features but does not name the third parties that receive user data."
"The consent request appears after user data has already been transmitted."
"We were unable to find a mechanism for users to withdraw consent for third-party data sharing."

Reviewer reply template

Hello App Review team,

Thank you for the feedback under Guideline 5.1.2(i).

Our app uses a third-party AI provider for [feature]. We have updated the
app to disclose this and obtain explicit consent before any data is sent:

Provider named
  - The provider is [OpenAI / Anthropic / Google], named on the consent
    screen and in our privacy policy.

Consent before first request
  - On first use of [feature], the app shows a full-screen disclosure:
    "When you use [feature], the text you enter and the current
     conversation are sent to [Provider] to generate a response.
     [Provider] does not use this content to train its models on our
     API tier. See our Privacy Policy for details."
  - The user must tap "Allow" to proceed. No request is made before that.
  - Steps to reproduce: fresh install, open [feature], the disclosure
    appears before any network call.

What is sent
  - Only [the user's prompt and the last N messages]. No contacts,
    photos, or location are sent.

Withdraw consent
  - Settings > Privacy > "AI features" toggle disables all third-party
    AI calls.

Disclosure alignment
  - Privacy policy: https://example.com/privacy names [Provider] as a
    subprocessor, with data categories, retention, and training terms.
  - App Privacy: "User Content" is disclosed as collected by a
    third-party partner and linked to the user.

Build: [version] ([build number])

Copy-paste privacy policy AI clause

Third-Party AI Processing

Some features of [App Name] (for example, [chat replies / summaries /
transcription]) work by sending your input to a third-party artificial
intelligence provider. We use the following provider(s):

  - [OpenAI, L.L.C.] - see https://openai.com/policies/privacy-policy
    and https://openai.com/policies/business-terms

When you use these features, we send: the text, images, or audio you
provide for that feature, and the recent context of your session. We do
not send your name, email, contacts, precise location, or payment
information to the provider.

We use the provider's [API / business] tier. Under that tier, the
provider does not use your content to train or improve its models, and
retains it only transiently to return a result and for a limited abuse-
monitoring window as described in the provider's terms.

We ask for your explicit consent before your data is sent to the
provider for the first time. You can withdraw consent at any time in
Settings > Privacy > AI Features, which disables these features.

We do not sell this data or use it for cross-app advertising.

Fill in the real provider, tier, and data categories — an inaccurate clause is worse than none, because it will contradict what the reviewer observes.

App Store AI Rejection: Guideline 5.1.2 & Third-Party AI Disclosure (2026)