Guideline 5.1.1 Rejection: How to Fix It (2026)

App Review sent your build back with a Guideline 5.1.1 message about data collection and storage, or a Guideline 5.1.1(v) message about account sign-in and deletion. These are two different problems that share a section number, and the fix depends on which subsection the reviewer cited. If your rejection is about a missing, broken, or login-gated privacy policy URL, a hosted policy page resolves it in minutes → privacy policy page generator. If it is about account creation with no in-app deletion, you need a hosted deletion path → account deletion page generator.

This guide is practical, not legal advice. It explains what each subsection means, the four triggers behind almost every 5.1.1 rejection, the exact fix for each, and a copy-paste reply you can send back to the reviewer.

What Guideline 5.1.1 actually covers

Guideline 5.1.1 is titled "Data Collection and Storage" and has several lettered subsections. The ones that generate rejections are:

5.1.1(i) Privacy Policies — every app must link to a privacy policy in the App Store Connect metadata field and inside the app. The policy must identify what data the app collects, how, and every use of it; confirm that third parties (analytics, ad networks, SDKs, parent and subsidiary companies) give equal protection; and explain data retention and deletion, including how a user revokes consent or requests deletion.
5.1.1(ii) Permission — you must get consent before collecting user or usage data, even anonymous data, and provide a way to withdraw consent. Purpose strings must fully describe the use.
5.1.1(iii) Data Minimization — only request data your core functionality needs. Optional signup fields such as birthdate, full name, phone number, or city are a frequent trigger.
5.1.1(v) Account Sign-In — if the app has no significant account features, allow use without login. If it supports account creation, it must also offer account deletion within the app.

Read the current text on Apple's site: developer.apple.com/app-store/review/guidelines.

Which one did you get: 5.1.1 or 5.1.1(v)?

Open Resolution Center and read the subsection in parentheses. A bare "Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage" with a paragraph about your privacy policy is an (i) problem. A message that says "your app supports account creation but does not appear to include an option to initiate account deletion" is a (v) problem. A message about a signup form asking for information the app does not need is (iii). They are fixed differently, so do not guess.

Trigger 1: privacy policy URL missing, broken, or behind a login

This is the single most common 5.1.1 rejection. Reviewers check the URL in the App Privacy section of App Store Connect and the link inside the app. It fails when:

No URL is entered in App Store Connect at all (the field is under App Privacy, not App Information).
The URL returns a 404, times out, or is a PDF or Google Doc that requires sign-in.
The link works on the web but the in-app link is missing, buried, or opens a blank web view.
The policy sits behind a paywall or an account wall.
The domain is unreachable from outside your home region.

Fix: publish the policy at a stable public HTTPS URL that loads with no login and no cookie wall. Put the same URL in the App Store Connect privacy policy field and behind a visible "Privacy Policy" link in the app, typically in Settings or on the sign-in screen. Generate a hosted page here: /privacy-policy-page-generator. Then reply to the reviewer with the exact URL and the in-app location.

Trigger 2: the policy does not match the data you collect

Apple cross-checks three things against each other: your App Privacy answers (the nutrition label), your actual SDK list, and your written privacy policy. If your app bundles Firebase, an ad SDK, an attribution SDK, or a crash reporter and your policy says "we do not share your data with third parties," you get rejected. Apple's App Privacy guidance requires you to disclose data collected by third-party partners, meaning any analytics tool, ad network, or SDK whose code you ship (developer.apple.com/app-store/app-privacy-details).

Fix: list every SDK, then write policy language for each one: what it collects, why, and the link to its own policy. Our clause library covers the common vendors: SDK privacy policy clauses. If you use Firebase, see Firebase privacy policy generator. Then align your App Privacy answers so "Data Linked to You," "Data Not Linked to You," and any "Data Used to Track You" entries match the policy exactly. You can update App Privacy answers without submitting a new build.

Trigger 3: account creation but no in-app deletion (5.1.1(v))

Since June 30, 2022, any app that supports account creation must let users initiate account deletion from within the app. Apple's support page is explicit: offering only to temporarily deactivate or disable an account is insufficient, you must offer to delete the entire account record and associated personal data, and linking out to a web browser to do it is "a poor user experience and is not appropriate." If the final step must happen on your website, you may link directly to that specific page, but the flow has to start in the app (developer.apple.com/support/offering-account-deletion-in-your-app).

Fix:

Add a "Delete Account" control in the app, near account settings, not hidden behind support chat.
On tap, confirm intent, then either delete server-side immediately or open the exact deletion page on your site. Publish that page here: /account-deletion-page-generator.
Delete the account record plus associated data you are not legally required to keep, including user-generated content shared with others.
If the app uses Sign in with Apple, call the Sign in with Apple REST API to revoke the user's tokens as part of deletion.
Document the deletion method and any retained-data categories in your privacy policy.

Background on the requirement: App Store account deletion requirement.

Trigger 4: the App Tracking Transparency string is missing

If your app or any SDK links data to a user or device with third-party data for advertising, or shares identifiers with a data broker, Apple requires an App Tracking Transparency prompt and an NSUserTrackingUsageDescription key in Info.plist. A common 5.1.1 or 5.1.2 rejection reads: "Your app uses the AppTrackingTransparency framework, but we are unable to locate the purpose string." It also fails the other way: an ad or attribution SDK is present, "Data Used to Track You" is set on the label, but there is no ATT prompt in the build.

Fix: add a clear NSUserTrackingUsageDescription value that names the benefit to the user, call requestTrackingAuthorization before any tracking starts, and make sure your App Privacy answers and your privacy policy both describe the tracking. See developer.apple.com/documentation/apptrackingtransparency and developer.apple.com/app-store/user-privacy-and-data-use.

The reviewer reply template

After you fix the issue, reply in Resolution Center. Be specific, name the guideline, and give exact locations. Adapt this:

Hello App Review team,

Thank you for the feedback under Guideline 5.1.1.

We have addressed each point:

1. Privacy policy (5.1.1(i))
   - Public URL (no login required): https://example.com/privacy
   - This URL is set in App Store Connect > App Privacy > Privacy Policy.
   - In-app link: Settings tab > "Privacy Policy" (also on the sign-in screen).
   - The policy now lists every third-party SDK we use
     (Firebase Analytics, Crashlytics, [SDK]), the data each collects,
     the purpose, and a link to each vendor's policy.

2. Data matches disclosure
   - Our App Privacy answers have been updated to match the policy:
     [list the data types].

3. Account deletion (5.1.1(v)) [include only if cited]
   - "Delete Account" is now available at: Profile > Account > Delete Account.
   - Steps to reproduce: sign in with the demo account below, open Profile,
     tap Account, tap Delete Account, confirm.
   - Deletion removes the full account record and associated personal data.
     Sign in with Apple tokens are revoked via the REST API.

4. App Tracking Transparency [include only if cited]
   - NSUserTrackingUsageDescription is present in Info.plist.
   - The prompt appears on first launch before any tracking SDK initializes.

Demo account: user@example.com / [password]
Build: [version] ([build number])

Please let us know if anything else is needed.

How a hosted policy plus a hosted deletion page close the two common variants

The two rejections that account for most 5.1.1 traffic are "your privacy policy URL is not working / not present" and "you support account creation but do not offer in-app deletion." Both are solved with a stable, public, login-free page you control. A hosted privacy policy gives you one canonical URL for App Store Connect and the in-app link, and it is easy to keep in sync with your SDK list. A hosted account-deletion page gives you the direct link Apple allows you to open from the in-app "Delete Account" button when the final step is web-based. Generate both here: /privacy-policy-page-generator and /account-deletion-page-generator, or start from /create.

This article is general guidance for developers and is not legal advice. If you have questions about your obligations under a specific privacy law, consult a qualified attorney.

Guideline 5.1.1 & 5.1.1(v) Rejection: How to Fix It (2026)