App Store rejection guide

Apple wants Sign in with Apple in your app (Guideline 4.8): do you need it?

Last reviewed 3 November 2026

If people can sign in to your app with Google, Facebook or a similar service, Apple usually expects a privacy-focused option next to it. Adding the button is the easy part. The details that catch teams out are hidden emails and existing accounts.

Short answer

If a third-party or social login sets up someone’s main account in your app, you must also offer an equivalent login service that meets Apple’s three privacy conditions. Sign in with Apple is the obvious choice. Some apps are exempt, including those that only use their own sign-in system.

What Apple is saying

“must also offer as an equivalent option another login service”
Apple, App Review Guideline 4.8

That other login service has to meet three conditions:

It limits data collection to the person’s name and email address.
It lets people keep their email address private when they set up their account.
It doesn’t collect their activity in your app for advertising without consent.

The rule applies to the person’s primary account: the one they use to identify themselves, sign in and reach your features. Connecting a calendar or a social account to an existing account for one feature is a different thing.

Who doesn’t need it

Apple lists these exceptions:

The app only uses your company’s own account and sign-in system.
It’s an alternative app marketplace, or distributed from one, and uses a marketplace-specific login for accounts, downloads and commerce.
It’s an education, enterprise or business app that requires an existing education or enterprise account.
It uses a government or industry-backed citizen ID or electronic ID.
It’s a client for a specific third-party service, and people sign in directly to their mail, social media or other account there to reach their content.

Offering your own email sign-up next to Google doesn’t meet the first exception, because the app no longer uses only your own system.

The usual causes

Google or Facebook login only, or alongside your own email sign-up.
A new social login added in an update, without an equivalent option.
An option that isn’t equivalent: placed behind extra steps, or available only on some screens.
A login service that fails one of the conditions, such as one that doesn’t let people hide their email address.
A claimed exception that doesn’t apply, such as a consumer app that lets anyone sign up but calls itself a business app.

How to fix it

Check whether the rule applies using the conditions and exceptions above. If you’re exempt, explain which exception and why in your reply to App Review.
Add Sign in with Apple, or another service that meets all three conditions, and turn on the capability for your app.
Put it beside your other options, on the same screens, and follow Apple’s button design guidance.
Handle hidden emails. People may share a private relay address instead of their real one. Register your sending domains with Apple so your emails reach them.
Save the name the first time. Apple only sends the person’s name on their first sign-in, so store it then.
Plan for existing customers. Someone who used Google before may get a different email address through Apple, so a matching-by-email approach can create a second account. Offer a way to link the two.
Match it on your other platforms. If people also use your app on Android or the web, make sure they can reach the same account there.
Support account deletion and token revocation. See our account deletion guide.
Test it on a real device, then reply to App Review and resubmit.

Questions founders ask

Is Sign in with Apple mandatory?

Not by name. Apple requires an equivalent login service that meets its three privacy conditions. Sign in with Apple is Apple’s own option for this, but another service that meets them can work.

Our app only has email and password. Does 4.8 apply?

No. An app that only uses your company’s own account setup and sign-in is exempt.

Do we need it on Android too?

Guideline 4.8 applies to your Apple app. If the same accounts are used on Android or the web, plan how those people will get to their accounts there.

More rejection guides

Based on Apple’s App Review Guidelines as last updated by Apple on 16 October 2026. Apple changes them from time to time, so check the current text on Apple’s developer site.