Guideline 5.1.2: Third-Party AI, ATT and Data Sharing

Guideline 5.1.2 is Apple's rule on how personal data is used and shared. Its clause (i) comes down to three requirements: say what data leaves the app, name the third party that receives it, AI included, and get explicit consent before sending anything. For ad tracking, that consent must go through the App Tracking Transparency (ATT) prompt.

I got this rejection on Clic, my app that turns a product into slides with AI. This guide covers third-party AI, ATT and privacy labels. The privacy policy and permission requests fall under guideline 5.1.1.

What does guideline 5.1.2 say?

5.1.2, "Data Use and Sharing," follows 5.1.1 in the "Privacy" section of the App Review Guidelines. Most rejections come from its clause (i). The current text, updated on June 8, 2026, says in particular:

• "You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so."
• "You must receive explicit permission from users via the App Tracking Transparency APIs to track their activity."
• The app can't require users to turn on a system feature, like notifications, location or tracking, to get access to a feature, content or a reward.

In plain terms: you share nothing without saying so and getting consent. The rule states that an app sharing data without consent can be removed from sale, and its developer kicked out of the program.

The other clauses cover more specific cases:

Clause	What it forbids
5.1.2(ii)	Reusing data for another purpose without new consent
5.1.2(iii)	Secretly building a profile or de-anonymizing
5.1.2(iv)	Building a contact database or listing installed apps
5.1.2(v)	Contacting people from the contacts without the user asking
5.1.2(vi)	Using health, home or face-mapping data for marketing
5.1.2(vii)	Sharing Apple Pay data beyond delivering the service

What changed for third-party AI

On November 13, 2025, Apple clarified 5.1.2(i) in a guidelines update: you must clearly disclose where personal data is shared with third parties, "including with third-party AI," and get explicit permission first. The June 8, 2026 version keeps that sentence.

A rejection message posted in February 2026 on the Apple forums spells out what Apple expects. The app "does not clearly explain what data is sent, identify who the data is sent to, and ask the user's permission before sharing the data". The same message asks for the privacy policy to mention this sharing with a third-party AI too.

Going through your server changes nothing: if your server forwards the photo to OpenAI, the photo goes to OpenAI. The setup in the guide on API keys in an Expo app protects your key, not the user. You still need consent.

My Clic rejection: the screen was there, the policy wasn't

On September 16, 2026, Apple rejected Clic citing 5.1.1(i) and 5.1.2(i). The AI consent screen was in the app, though, and the reviewer had gone through it: their anonymous account and their generations were in the database before the rejection. What was missing was online: the published policy was the old version, which named OpenAI only once.

The fix, with no new build: a policy that names OpenAI, in the United States, and lists what gets sent to it for each mode. On top of that: the possible providers when users plug in their own API keys, a commitment that every provider protects data at least as well as the policy does, and an English summary for the reviewer. The same submission went back on September 21, 2026, with updated review notes.

Clic's consent screen, word for word

Here's what shows up before the first generation. Use it as a template: swap in your provider and your list.

• Overline, in caps: "Before your first generation".
• Title: "Clic creates your slides with OpenAI's AI".
• Text: "To analyze your product and generate your images, Clic sends the following to OpenAI, its AI provider:".
• List: "Your brief answers and the links you add"; "The photos you import, including avatar and references"; "The generated images, kept on the Clic server for your folders".
• A note: "With your own API keys, this data goes to the provider you connected."
• A link to the privacy policy.
• Two buttons: "I agree and continue" and "Decline".

If the user declines, the app shows "Nothing was sent" and the screen comes back on the next attempt. To withdraw consent, they delete their data from the settings, as 5.1.1(ii) requires: the screen comes back before any new send.

Don't mix this screen up with the one before a system permission. Before a camera access request, Apple wants a single button, "Continue," that opens the iOS prompt, per its design guidelines. AI consent has no system prompt behind it. Your screen is what collects consent: it needs a real choice, accept or decline.

Last trap: the reviewer has to see the screen. One developer got rejected several times because their screen depended on a misconfigured flag, according to their forum thread: "We were not presented with the consent prompt on launch or anywhere else in the app." Test on a fresh install, and say in the review notes when the screen appears.

ATT: when the tracking prompt is required

For Apple, tracking means linking data from your app with data from other companies' apps, websites or offline properties, for targeted advertising or ad measurement. Sharing data with a data broker counts too. The definition is on the User Privacy and Data Use page.

As soon as your app, or an SDK you put in it, does that:

• the App Tracking Transparency prompt comes before any collection used for tracking;
• the NSUserTrackingUsageDescription key explains why, and if it's missing your build can get rejected, as I explain in the ITMS-90683 guide;
• without consent, the advertising identifier is all zeros, and you don't track the user any other way: Apple forbids deriving device data to identify them;
• you're accountable for the SDKs you ship: "Developers are responsible for all code included in their apps."

You can't require tracking to unlock a feature or a reward: 5.1.2(i) forbids it. Apple's ATT FAQ answers "No" to that question, pointing to the same rule. You can, however, explain why you're asking for tracking before showing the prompt, as long as you stay transparent.

The typical rejection: the app collects tracking data without ever showing the ATT prompt. In a published rejection message, Apple offers two ways out. Either declare tracking in App Store Connect and add the ATT prompt before any collection, saying in the review notes where it appears. Or remove the tracking.

In the European Union, Apple is announcing a different version of the prompt starting with iOS 27.2. In France, Germany, Italy, Poland and Romania, only that version will be available. The cases where consent is required don't change.

Privacy labels in App Store Connect

The App Privacy section fills in the labels on your listing: data collected, linked to the user, used for tracking. The rules are on the App Privacy Details page. Three points matter for an app with AI:

• You also declare what your partners collect: analytics SDKs, ad networks, third-party providers whose code is in your app.
• Collecting has a precise meaning: sending data off the device and keeping it longer than needed to serve the request. Images your server keeps are collected. If you're unsure what your AI provider keeps, declare it.
• You can fix it anytime: "you do not need to submit an app update in order to change your answers". So a rejection that's only about labels gets fixed without a build.

Which consent for which third party

Here's the table I apply to my apps. It doesn't replace Apple's text or the GDPR.

Third party receiving the data	Consent to ask for	Where to declare it
Third-party AI: OpenAI, Gemini, Claude	Your consent screen, before the first send	Policy, labels, review notes
Analytics and diagnostics, no advertising	Consent to collection, 5.1.1(ii), and GDPR	Policy and labels
Ad network or attribution linked to other apps	ATT prompt before any tracking collection	"Tracking" labels, ATT text, policy
Data broker	ATT prompt	"Tracking" labels and policy

To fill it in, start from the code, not your memory: list every network call from the app and your server, with the data sent, the recipient and the purpose. For the policy itself, the method is in app privacy policy.

How to reply to Apple after a 5.1.2 rejection

Two cases. If the cause is online, policy or labels, you fix it, reply, and the same submission goes back without a build: that's what I did for Clic. If the cause is in the app, a missing screen or data sent before consent, you need a new build.

If your app sends nothing to a third-party AI, Apple's message covers that case: reply to confirm it, and add the information in the App Review Information section of App Store Connect.

Otherwise, reply in English by replying to the App Review message. Template to adapt, here for an app like Clic:

Hello,

Thank you for your review.

The app sends the user's brief, imported photos and
generated images to OpenAI, a third-party AI service,
to create slides.

- Before the first AI request, a dedicated screen names
  OpenAI, lists the data sent and asks for explicit
  consent. Nothing is sent if the user declines.
- The privacy policy describes this sharing, with an
  English summary: [URL]
- The App Privacy information in App Store Connect matches.

How to verify: install the app and start a first
generation. The consent screen appears before any data
is sent.

Best regards,

The 5.1.2 checklist before submitting

• Every third party receiving personal data is named, AI included.
• The consent screen appears before the first send, names the provider and lists the data.
• Declining sends nothing, and the app says so.
• Consent can be withdrawn from within the app.
• The screen appears on a fresh install, and the review notes say where.
• The online policy and the labels describe the same data flows, partners included.
• If the app or an SDK tracks the user, the ATT prompt comes before any tracking collection.
• No feature or reward depends on tracking or notifications.

Check your submission before Apple does

The Apple Review Kit bundles my pre-submission checklist, my fixed rejections and two Claude Code skills that review your project and your listing, then draft your reply if Apple rejects you. For a human eye, book an hour with me: we'll go through your app, your policy and your labels together. The full process is on the app rejected by Apple page, and other common reasons are in why Apple rejects an app.

If you're getting ready for your first launch, take the free diagnostic: it puts the steps in order and sends you my Apple anti-rejection checklist. The homepage shows how to build a mobile app with AI, without forgetting what the review checks.

Nobody can guarantee Apple will accept your app. What I can do is help you avoid a 5.1.2 rejection that already cost me one review cycle.

Frequently asked questions

What does "Guideline 5.1.2(i) - Legal - Privacy - Data Use and Sharing" mean?

It's the full name of the rule in Apple's message. It flags personal data being shared without clear disclosure or without consent: to a third-party AI, an ad SDK or another service. It often comes together with 5.1.1(i), which is about the privacy policy.

Do you need consent to use the OpenAI API in an app?

Yes, as soon as personal data goes to OpenAI: what the user types, their photos, their voice, their documents. Since November 2025, the rule explicitly mentions third-party AI. Name the provider, say what gets sent and get explicit consent before the first send, even if the call goes through your server.

Does AI running on the iPhone need to be declared?

If nothing leaves the device, there's no sharing with a third party, so no consent needed under 5.1.2(i), in my view. Apple hasn't spelled that out. As soon as part of the processing goes to a provider, apply the third-party AI rule.

Can you force users to accept tracking to unlock a feature?

No. 5.1.2(i) forbids requiring tracking, notifications or location to access a feature, content or a reward. The ATT prompt must stay a real choice, and the app respects a refusal.

Do you need a new build after a 5.1.2 rejection?

Not always. An incomplete policy or wrong labels get fixed online, and the same submission goes back. A missing consent screen, or one placed after the data is sent, needs a new build.

What's the difference between 5.1.1 and 5.1.2?

5.1.1 covers collection and storage: privacy policy, permissions, accounts. 5.1.2 covers what you do with the data afterward: sharing with third parties, AI included, ad tracking, reuse. A single rejection often cites both.