You asked ChatGPT (or Claude, or Gemini) to "write a privacy policy for my app," pasted the result into a Google Doc, linked it in App Store Connect, and App Review sent back a Guideline 5.1.1 or 5.1.2 rejection. This is one of the most common privacy rejections in 2026, and the fix is not a better prompt. Generate a hosted policy from your real SDK list instead → /privacy-policy-page-generator.
Why a reviewer can tell
App Review compares three things: the policy text, the App Privacy answers you gave in App Store Connect (the "privacy label"), and the SDKs and API calls Apple detects in your binary. A language model only sees the first one, and only the part you described to it. The gaps show up fast.
The policy contradicts your App Privacy label
Apple requires the privacy policy and the App Privacy label to describe the same data practices, including the practices of third-party SDKs you bundle. A model that writes "we do not collect any personal data" while your label declares "Identifiers linked to you" and your binary contains an analytics SDK is an automatic 5.1.1 rejection. The label and the policy must agree on every data type, on whether data is linked to identity, and on whether it is used to track.
"Third parties" instead of vendor names
Guideline 5.1.1(i) requires the policy to identify third parties with whom you share user data — "such as analytics tools, advertising networks and third-party SDKs" — and confirm that each provides equal protection of that data. "We may share data with trusted partners" names nobody. Reviewers want "Google (Firebase), AppsFlyer, Meta" with the data each one receives.
Invented or wrong data practices
Ask a model to describe your data flows and it will fill the gaps with plausible-sounding defaults: a "loyalty program," "we may share data with advertising partners for personalized ads," data-broker language, a CCPA "sale" opt-out you do not need, a cookie banner for an app with no webview. Every invented clause is something a reviewer, or a regulator, can hold you to, and something your app does not actually do.
Hallucinated citations and the wrong jurisdiction
Models routinely cite statutes that do not exist or are misnamed, apply GDPR articles to a US-only app, or state that COPPA covers users under 16 (it is under 13). Wrong legal claims in a policy are worse than none.
No hosted URL, or placeholder text
Guideline 5.1.1 requires a link that resolves to a real page, reachable without a login, in both App Store Connect and the app. Models leave "[Your Company Name]", "[Effective Date]", and "https://www.example.com/privacy" in the output, and those ship.
A bad AI paragraph vs a correct one
Data sharing, as a model typically writes it:
We may share your personal information with trusted third-party
partners and service providers who assist us in operating our
application and servicing you. These partners are contractually
obligated to keep your information confidential. We may also share
information with advertisers to show you relevant offers.
The same section, matched to a real app:
The app includes these third-party SDKs, which receive the data listed:
- Firebase Analytics and Crashlytics (Google LLC): app events, device
model, OS version, a Firebase installation ID, and crash logs.
Purpose: product analytics and crash diagnostics. Not used for ads.
- RevenueCat (RevenueCat, Inc.): a pseudonymous app user ID and your
purchase history. Purpose: managing your subscription entitlement.
- AppsFlyer (AppsFlyer Ltd.): IP address, device identifiers, and
install and event timestamps. Purpose: measuring which marketing
campaign led to an install. This is "tracking" under Apple's App
Tracking Transparency; the app asks permission before enabling it.
We do not sell personal data and we do not use it for cross-app
advertising. Each provider's terms require protection equal to this
policy.
Retention and deletion, as a model writes it:
We retain your information for as long as necessary to fulfil the
purposes outlined in this policy and as required by applicable law.
You may contact us at any time to exercise your rights.
The same section, specific:
We keep your account record until you delete your account, then remove
it from backups within 30 days. Analytics events are retained for 14
months. You can delete your account and all associated data in the app
at Settings > Account > Delete Account, or by emailing
privacy@example.com; deletion completes within 30 days. Deleting your
account also revokes your Sign in with Apple token.
Legal references, as a model writes them:
This Privacy Policy complies with the California Online Privacy Act of
2015, the EU Cookie Directive 2019, and COPPA for all users under the
age of 16.
None of those are real as written. The California law is CalOPPA, enacted in 2003. There is no "EU Cookie Directive 2019." COPPA protects children under 13. If your app is US-only with no children, the honest version is one or two sentences: "This policy is governed by the laws of [state], United States. The app is not directed to children under 13 and does not knowingly collect their personal information."
Checklist to audit an AI-drafted policy
- Every SDK in your project file appears in the policy by vendor name, with its data types and purpose.
- Every data type in your App Privacy label appears in the policy, and every data type in the policy appears in the label.
- "Tracking" (App Tracking Transparency) is disclosed if any SDK uses the advertising identifier or shares data for cross-app advertising.
- The retention section gives real timeframes, not "as long as necessary."
- The deletion section gives the exact in-app path plus a contact address, and matches your actual account-deletion implementation.
- No placeholders: company name, effective date, contact email, and URL are all filled in.
- Legal references are real, correctly named, and actually apply to your users.
- No clauses for things the app does not do (no data sale, no ad personalization, no cookies) unless they are true.
- The URL loads publicly, with no login, and is identical in App Store Connect metadata and in the app.
- For anything sent to a model provider, the specific provider is named and consent is requested first — see the Guideline 5.1.2 third-party AI guide.
When an LLM does help
A model is useful for learning what a clause means, for drafting the plain-language structure of a policy, for turning your own notes on data flows into readable prose, and for spotting missing sections. It is not a source of truth about what your app collects; that comes from your dependency list, your backend, and your privacy label. Use the model to phrase facts you supply, never to supply the facts.
The fix
Make the SDK list the input. List every dependency, note what each one sends and why, answer the App Privacy questions from that same list, then generate a hosted policy that reflects it. A generated policy from the privacy policy page generator stays consistent with the label because both come from the one list, and it is hosted at a stable URL you can paste into App Store Connect and Google Play. This is general information, not legal advice; if your app handles sensitive data or serves regulated markets, have a lawyer review it.
Replying to the reviewer
Hello,
Thank you for the review. We have replaced our privacy policy with one
that matches the app's actual data practices and our App Privacy
information.
Hosted policy (public, no login):
https://example.com/privacy
Changes made:
- Every third-party SDK is now named (Firebase / Google, AppsFlyer,
RevenueCat) with the data it receives and the purpose.
- The policy now matches our App Privacy label on all data types,
linkage, and tracking.
- Added specific data retention periods and the in-app deletion path
(Settings > Account > Delete Account).
- Removed clauses that did not apply to this app and corrected the
legal references.
The same URL is set in App Store Connect metadata and is linked on the
app's settings screen. Please let us know if anything else is needed.
Related
See COPPA 2026 for kids apps, the Guideline 5.1.2 third-party AI rejection guide, and the app SDK privacy-policy clause library. Build a policy matched to your SDKs with the privacy policy page generator, and add in-app deletion with the account deletion page generator.