The short answer
Apple and Google require accurate privacy disclosures that match what your app and its SDKs collect: a privacy manifest and App Tracking Transparency permission on iOS, privacy nutrition labels and a Google Play Data safety section, in-app account deletion for apps with accounts, moderation tools for user-generated content, and an age rating that matches the content.
Key takeaways
- iOS apps need a privacy manifest declaring required-reason APIs and tracking domains.
- Tracking across apps and websites on iOS needs App Tracking Transparency permission first (Guideline 5.1.2).
- Privacy labels and the Data safety section must match what the app and every SDK actually collect.
- If users can create an account in the app, they must be able to delete it in the app (Apple 5.1.1(v); Google Play account deletion).
- SafeLaunch reads an .ipa, .apk or .aab summary (permissions, SDKs, privacy manifest) and drafts your App Store and Google Play privacy answers.
On this page
01
What do Apple and Google require?
| Requirement | Store | Reference |
|---|---|---|
| Privacy manifest declaring required-reason APIs and tracking domains | Apple | Apple privacy manifest |
| App Tracking Transparency permission before tracking | Apple | Guideline 5.1.2 |
| Accurate privacy labels and Data safety section | Both | Guideline 5.1.1; Play Data safety |
| In-app account deletion for apps with accounts | Both | Guideline 5.1.1(v); Play account deletion |
| Filtering, reporting and blocking for user-generated content | Both | Apple 1.2; Play User Generated Content policy |
| Age rating that matches the content | Both | Apple 2.3.6; Play IARC content rating |
02
What if children use the app?
In the US, COPPA applies to services directed to children under 13 or with actual knowledge of collecting from them. The amended COPPA Rule took effect on 23 June 2025, with full compliance required from 22 April 2026: verifiable parental consent, separate consent before sharing children's data with third parties including for targeted ads, a written retention policy and a written security program. The GDPR, UK Age Appropriate Design Code and India's DPDP Act add their own duties.
03
How SafeLaunch checks a mobile app
- Upload an .ipa, .apk or .aab. SafeLaunch sends a summary of permissions, SDKs and the privacy manifest for analysis, not the app itself.
- Store rules and privacy law together: the app is checked against the store requirements and the privacy laws of the markets you choose.
- Draft store answers: Launch Fix drafts your App Store privacy answers and Google Play Data safety answers from what the app contains.
- Source code too: connect the repository for the code checks, such as exposed keys and data handling.
Start with a free scan before you submit for review.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
FAQ
Frequently asked questions.
Sources and further reading
- Apple: App Store Review Guidelines
- Apple: privacy manifest files
- Google Play: Data safety section
- FTC: COPPA Rule
This article is general information, not legal advice. SafeLaunch is automated software, not a law firm; a report records what was checked on one version and is not a certificate of compliance. Read the disclaimer.
From the founder
SafeLaunch is built by Raghav R Handa, a lawyer-turned-builder in New Delhi. He writes about this topic in plain English:
See what SafeLaunch finds on your product.
Paste a link and get your score, the most serious problems and what already passes, in about a minute.
Keep reading