Account Deletion, Privacy Labels and 5.1.1: Passing Apple's Privacy Review

Privacy is where many App Store submissions stumble, and it's usually not because the app does anything shady. It's because the paperwork doesn't match the product: a privacy label that says "no data collected" while an analytics SDK quietly collects it, a permission prompt that says "this app needs your location" and nothing more, or an account that can be created in ten seconds but never deleted.

Apple's guideline 5.1.1 and its related rules are predictable once you know them. This guide covers each requirement, the exact wording that matters, how to implement it in a React Native or Expo app, and a checklist to run before every submission.

Key takeaways

• Account deletion: if users can create an account, they must be able to start deleting it from inside the app. Temporary deactivation alone isn't enough.
• Privacy policy: linked in your App Store Connect metadata and somewhere easy to find inside the app.
• Purpose strings: every permission prompt must clearly and completely explain how the data is used.
• App Privacy labels: must match what your app and every SDK in it collect.
• Tracking: if you track users across other companies' apps or websites, you need explicit permission through App Tracking Transparency, and you can't make features depend on it.

Requirement 1: account deletion

Apple's rule (5.1.1(v)): "If your app supports account creation, you must also offer account deletion within the app."

Apple's support page adds the details that trip teams up:

Highly regulated industries (for example financial services) may add customer-service steps to confirm deletion. Most apps should make it a two-tap flow with a confirmation.

Google Play has a similar rule: apps that allow account creation must let users request deletion in the app and through a web link added in Play Console. Build one flow that satisfies both stores.

Requirement 2: a privacy policy in two places

5.1.1(i): "All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner." The policy should say what data you collect, how, why, who you share it with, how long you keep it, and how users can delete it.

Requirement 3: purpose strings that actually explain

5.1.1(ii) asks you to "ensure your purpose strings clearly and completely describe your use of the data." Reviewers read the text of every permission prompt.

In Expo, set these in ios.infoPlist (for example NSCameraUsageDescription) or through the permission options of the relevant config plugin, so every build carries the right text.

Also ask at the right moment: request camera access when the user taps "Scan", not on the first launch. Apple also forbids making features depend on enabling unrelated permissions.

Requirement 4: App Privacy labels that match reality

The App Privacy section in App Store Connect describes what data your app collects and how it's used. Reviewers compare it with your app's behaviour, and the label is shown to users on your store page.

The usual mistake is forgetting SDKs. Make a list of everything in your app that sends data anywhere:

• Analytics (product analytics, attribution)
• Crash reporting and performance monitoring
• Authentication providers
• Payments and subscription tools
• Push notification services
• Ads, if any

For each, check the vendor's documentation for what it collects, and declare it. Update the label whenever you add an SDK.

Requirement 5: tracking and App Tracking Transparency

5.1.2(i): "You must receive explicit permission from users via the App Tracking Transparency APIs to track their activity." Tracking here means linking data from your app with data from other companies' apps or websites for advertising or measurement, or sharing it with data brokers.

The same guideline also says your app "may not require users to enable system functionalities (e.g. push notifications, location services, tracking) in order to access functionality". So no "allow tracking to continue" screens.

If you don't track, don't show the prompt. Many apps don't need it at all.

Requirement 6: the privacy manifest

Separately from the label, the privacy manifest (PrivacyInfo.xcprivacy) declares why your app and its SDKs use "required reason" APIs such as user defaults or file timestamps. Missing declarations are flagged when you upload the build. In Expo, add them under ios.privacyManifests in your app config.

From the field: Expetitle, the real estate closing platform I built for buyers, sellers, realtors and brokers, handled documents and personal information to escrow-grade standards: role-based access, audit trails, encrypted storage and careful PII handling. Apps like that live or die on getting privacy right, both technically and in what you declare to Apple.

The privacy checklist (run before every submission)

• Delete account option inside the app, working end to end.
• Web deletion link added in Google Play Console.
• Privacy policy linked in App Store Connect and inside the app.
• Every purpose string explains the specific use.
• Permissions requested in context, not at launch.
• App Privacy answers updated for every SDK.
• Tracking prompt only if you actually track, and nothing gated behind it.
• Privacy manifest declares all required-reason APIs.

FAQ

Does every app need an account deletion option?

Every app that lets users create an account does, on both the App Store and Google Play. Users must be able to start deletion inside the app. You can finish the process on a website, as long as the link goes directly to the deletion page.

What should a purpose string say?

It should state the specific reason in the user's terms, for example "Show studios near you" rather than "Location is required". Apple asks that purpose strings "clearly and completely describe your use of the data", and reviewers check them.

Do I need the App Tracking Transparency prompt?

Only if you track users across apps and websites owned by other companies, for example for targeted advertising or ad measurement, or share data with data brokers. If you don't, don't show the prompt. If you do, you can't make app features depend on users allowing it.

What happens if my App Privacy label is wrong?

Your app can be rejected, or flagged later, and users see inaccurate information on your store page. Check every SDK's data collection, update the label before submitting, and revisit it whenever you add or remove a service.

Next steps

If you're preparing an app that handles personal or sensitive data and want the privacy side checked before Apple reviews it, I can audit your flows, labels and SDKs. Get in touch, or see my services.

Sources

• App Review Guidelines (5.1.1, 5.1.2), Apple
• Offering account deletion in your app, Apple
• User privacy and data use, Apple
• App privacy details on the App Store, Apple
• Understanding Google Play's account deletion requirements, Google Play Console Help
• Privacy manifests, Expo