# Does my iOS app need a privacy policy?

> Yes: every iOS and macOS app needs a Privacy Policy URL in App Store Connect, even if it collects nothing. What guideline 5.1.1(i) says it must cover, and how it differs from App Privacy answers and the privacy manifest.

- Canonical page: https://obelisk.club/blog/ios-app-privacy-policy-requirements
- Author: Peter Zhang
- Published: 2026-11-01
- Tags: app-store, privacy, privacy-policy, app-review, guidelines, ios, indie

**Yes. Every iOS and macOS app needs a privacy policy URL in App Store Connect, even if the app collects nothing.** Apple's App Information reference says the Privacy Policy URL is "Required for iOS and macOS apps", and guideline 5.1.1(i) says "All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner." The policy has to say what data the app collects (if any), how, and what it is used for; confirm that third parties get the same protection; and explain retention, deletion and how to withdraw consent. It is a separate thing from the App Privacy answers you give in App Store Connect and from the `PrivacyInfo.xcprivacy` file in your build. This page is not legal advice: laws such as GDPR, CCPA and PIPL may add requirements that Apple's pages do not cover, so check the ones that apply to you.

To write a first draft from yes/no answers, use the [privacy policy generator](/tools/app-privacy-policy-generator). For the other two pieces, see the [App Privacy answers helper](/tools/app-privacy-nutrition-label), the [privacy manifest generator](/tools/privacy-manifest-generator) and the [required reason API scanner](/tools/required-reason-api-scanner).

## What guideline 5.1.1(i) says the policy must cover

Apple's wording, from the App Review Guidelines: "The privacy policy must clearly and explicitly:"

- "Identify what data, if any, the app/service collects, how it collects that data, and all uses of that data."
- "Confirm that any third party with whom an app shares user data (in compliance with these Guidelines)—such as analytics tools, advertising networks and third-party SDKs, as well as any parent, subsidiary or other related entities that will have access to user data—will provide the same or equal protection of user data as stated in the app's privacy policy and required by these Guidelines."
- "Explain its data retention/deletion policies and describe how a user can revoke consent and/or request deletion of the user's data."

Two details matter. The link goes in two places: the App Store Connect metadata field and inside the app, "in an easily accessible manner". And the phrase "if any" means a policy is still expected when the answer is "nothing".

## Three things that sound alike

| | Privacy policy | App Privacy details ("nutrition label") | Privacy manifest |
|---|---|---|---|
| Where it lives | A public web page; its URL goes in App Store Connect and inside the app | Your answers in App Store Connect, shown on the App Store product page | `PrivacyInfo.xcprivacy`, a property list bundled in your app or SDK |
| Who reads it | People, and App Review | People deciding whether to download | Xcode and App Store Connect checks; developers using an SDK |
| What it covers | Data collected, how, all uses, third-party protection, retention, deletion and consent withdrawal (5.1.1(i)) | The privacy practices of your app, including third-party partners whose code you integrate | Types of data collected, required reason APIs used, and tracking (`NSPrivacyTracking`) |
| Who is required | All iOS and macOS apps | Required to submit new apps and updates | Apple lists which SDKs need one; apps and SDKs that use a required reason API must declare it |
| Update | Edit the URL while the app is in an editable status; URL changes release with your next app version | Apple: "You may update your answers at any time" with no app update needed | Ships with the build |

Apple's own pages do not say that one replaces another, so keep all three consistent: what the policy says, what the App Privacy answers say, and what the build actually does. Apple tells you that "You're responsible for keeping your responses accurate and up to date" for the App Privacy answers. The answers cover "analytics tools, advertising networks, third-party SDKs, or other external vendors whose code you've added to your app", and the guideline lists the same kinds of third parties for the policy.

On the manifest, Apple describes it as a property list that "records" the types of data collected and the required reasons APIs used, and says "By default, the file is named `PrivacyInfo.xcprivacy`; this is the required file name for bundled privacy manifests." If an upload is rejected over it, read [ITMS-91053 and ITMS-91055](/blog/itms-91053-itms-91055-privacy-manifest) and [ITMS-91061](/blog/itms-91061-missing-privacy-manifest-sdk).

## Where to enter it

In App Store Connect, open the app, choose App privacy in the sidebar, click Edit next to Privacy Policy, and enter the URL. Apple lists the roles that can do this as Account Holder, Admin, App Manager or Marketing. You can localize the URL for the languages your app is available in. A separate "user privacy choices" URL is optional.

The App Privacy details page describes the field as "The URL to your publicly accessible privacy policy." Beyond "publicly accessible", Apple does not say where the page must be hosted. In our experience any stable HTTPS page you control works, as long as the link opens without a login; Apple lists broken links among review issues, and our [submission checklist](/blog/app-store-submission-checklist) has that check. Keep the same page linked from inside the app, since the guideline asks for both.

## If your app has accounts

Guideline 5.1.1(v): "If your app supports account creation, you must also offer account deletion within the app." The same guideline says that if the app does not include significant account-based features, "let people use it without a login". Your policy's deletion section (5.1.1(i)) should match what the in-app deletion actually does.

## If your app is on tvOS

Apple's reference says: "If your app has a tvOS platform, the text of your privacy policy in the Apple TV Privacy Policy field is required." So tvOS takes the policy text itself in that field, not only a URL.

## If your app collects nothing

Apple's guideline says "what data, if any", so a short policy is allowed. Our general advice, not Apple's: say plainly that the app collects no personal data, and then check that this is true. Third-party SDKs, crash reporters, analytics and web views count, and so does anything your server logs. Mention what stays on the device, how a user deletes it (usually by deleting the app), and a way to contact you. If that is no longer true after a later update, change the policy and the App Privacy answers in the same release. For a plain-language page written this way, see our own [security and compliance page](/security).

## Sources

All read on 1 November 2026.

- [App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/#5.1.1), 5.1.1 Data Collection and Storage, items (i) and (v)
- [App information](https://developer.apple.com/help/app-store-connect/reference/app-information/app-information), App Store Connect Help (Privacy Policy URL, tvOS policy text)
- [Manage app privacy](https://developer.apple.com/help/app-store-connect/manage-app-information/manage-app-privacy), App Store Connect Help (entering privacy policy information)
- [App privacy details on the App Store](https://developer.apple.com/app-store/app-privacy-details/)
- [Privacy manifest files](https://developer.apple.com/documentation/bundleresources/privacy-manifest-files), Bundle Resources

*Apple's pages change, and this is not legal advice; check the pages above and the laws that apply to you.*