App Store rejection guide

Guideline 5.1.1 (Data Collection and Storage): how to fix it

Last reviewed 18 October 2026

5.1.1 rejections are about how your app asks for data, uses it and lets people remove it. The fixes are usually small changes to screens and text, but they have to be exact.

Short answer

Apple thinks your app asks for more data or permissions than it needs, doesn’t explain why, makes people sign up too early, or doesn’t let them delete their account. Fix the specific point named in the rejection, and make sure your privacy policy and App Privacy details match what the app really does.

What Apple is saying

“If your app supports account creation, you must also offer account deletion within the app.”
Apple, App Review Guideline 5.1.1

Guideline 5.1.1 has ten parts, and the rejection names the one you missed. These five cause most rejections:

(i) Privacy policy: every app needs one, linked in App Store Connect and easy to find inside the app, saying what you collect, how, how you use it, how third parties protect it, how long you keep it and how people can withdraw consent or ask for deletion.
(ii) Permission: you need consent to collect data, a clear way to withdraw it, and purpose strings that fully explain why you need each permission. Paid features can’t depend on people granting access.
(iii) Data minimisation: only ask for what the app’s core features need, and use the system pickers instead of full access to Photos or Contacts where you can.
(iv) Access: respect people’s choices, don’t trick or pressure them into granting access, and offer an alternative when they say no, such as typing an address instead of sharing location.
(v) Account sign-in: if the app has no significant account-based features, let people use it without signing in. If it lets people create an account, it must let them delete it from inside the app. Don’t require personal information the core features don’t need.

The other parts cover social network logins, regulated fields such as finance and healthcare (which must be submitted by the legal entity providing the service), and optional contact details.

The usual causes

Vague permission text, like “This app needs your location.”
Permission prompts on first launch, before people know what the app does.
Forced sign-up before anyone can see anything, when the app doesn’t need an account.
No account deletion in the app, or only an email address to ask for it.
Personal details the feature doesn’t need, such as a phone number or date of birth.
A privacy policy that’s missing, broken, generic or out of date.
App Privacy details in App Store Connect that don’t match the app or the SDKs inside it.

How to fix it

Find the part named in the rejection and fix that first.
Rewrite each permission message to say what the data is used for and what the person gets. For example: “Your location is used to show gyms near you.” Apple has a guide to writing clear purpose strings.
Ask in context: request a permission when someone taps the feature that needs it, not at launch.
Remove what you don’t need, including permissions pulled in by third-party SDKs. Use the system photo picker instead of full photo library access where you can.
Let people look around before sign-up if the core features don’t need an account.
Add in-app account deletion: easy to find, usually in settings, and it deletes the account and its data rather than just deactivating it. If you offer Sign in with Apple, revoke the person’s tokens when they delete. Apple explains the details in offering account deletion.
Update the privacy policy and App Privacy details so they match what the app and its SDKs collect.
Reply to App Review listing each change, with screenshots of the new flow. See how to reply.

Related: privacy manifests

Separately from 5.1.1, Apple requires a privacy manifest for apps and SDKs that use certain system APIs, which Apple calls required reason APIs. Missing declarations are flagged when you upload the build, before review starts.

Questions founders ask

Is a link to a web page enough for account deletion?

Deletion has to be possible to start from inside the app. A link that goes straight to the page where people complete deletion can work; a general support email or contact form isn’t enough.

Do I need a privacy policy if the app collects nothing?

Yes. Every app needs a privacy policy link in App Store Connect, even if it says the app collects no data.

An SDK collects the data, not our code. Does that count?

Yes. You’re responsible for what third-party SDKs in your app collect, and it has to appear in your App Privacy details.

More rejection guides

Based on Apple’s App Review Guidelines as last updated by Apple on 16 October 2026. Apple changes them from time to time, so check the current text on Apple’s developer site.