Privacy Policy URL
Get URL

App Store rejection under Guideline 5.1.1: fix the privacy policy link and resubmit

By Paul Cranmer, Founder · Last verified October 2026 · App Store Connect · App Review · Guideline 5.1.1

A rejection headed Guideline 5.1.1, Legal, Privacy, Data Collection and Storage almost always comes down to one sentence in the guidelines: all apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner. Reviewers reject when the field is empty, the link opens a homepage or a PDF, the page does not describe the data the app collects, or the app has no link inside it at all. This page quotes the guideline, shows both places the link goes, and lists what the page must say so the resubmission passes.

Who this is for

  • Developers holding a 5.1.1 rejection email and a build they want approved this week
  • Indie and agency teams whose App Store Connect privacy field was skipped at first submission
  • Anyone whose policy page exists but does not say what the app collects or how to delete it

Not for

  • Rejections under 5.1.1(ii) to (x) about consent, permissions or account deletion flows (related, not the same fix)
  • Legal advice for a specific jurisdiction

What the platform requires

  • Guideline 5.1.1(i): all apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner.
  • The policy must identify what data the app collects, how it collects it and all uses of that data.
  • It must confirm that third parties receiving user data (analytics tools, advertising networks, third-party SDKs, parent or related entities) provide the same or equal protection of user data.
  • It must explain data retention and deletion and describe how a user can revoke consent or request deletion.
  • The link must open a public HTTPS web page, not a PDF, a download or a login-walled page.

Get a live URL first

Mobile apps are on our free path. Choose App (iOS / Android) in the wizard, name the app, tick the SDKs it ships, and you get a live HTTPS page that states collection, uses, third parties, retention and deletion in the order the guideline lists them. Paste it in App Store Connect and link it from the app's settings screen.

Get the privacy policy URL for your app (free)

Step-by-step: paste your privacy policy URL

  1. Read which sub-point the rejection names. In App Store Connect open the app, then the rejected version's Resolution Center message. 5.1.1(i) is the privacy policy link; 5.1.1(v) is account deletion; the others are consent and data minimization. This page fixes (i).
  2. Create or repair the policy page. Run the wizard as a Mobile App with the real data types and SDKs, or edit your existing page so it names the data collected, every use, every third party that receives it, retention, and how a user deletes data or withdraws consent. One public HTTPS page, no PDF.
  3. Paste the URL in App Store Connect. App Store Connect → My Apps → the app → App Information → General Information → Privacy Policy URL. Save. The field is per app, not per version.
  4. Link the same URL inside the app. Add a Privacy Policy row to the app's settings or about screen that opens the URL in a web view or the browser. Reviewers look for it; a link only in the store listing is the most common reason a resubmission fails again.
  5. Align App Privacy and reply in Resolution Center. Make sure the App Privacy answers (data types, tracking) match the page. Resubmit the build and reply to the rejection stating where the link is in the app and that the policy now covers collection, third parties and deletion.

Field labels to look for

App Information → Privacy Policy URL
Under General Information, next to the category fields. Applies to every version.
Resolution Center
Where the rejection text lives and where you answer; quote the screen that holds the in-app link.
App Privacy
The data-collection questionnaire; its answers must not contradict the policy page.

Common reasons the form fails

  • A homepage or a PDF as the URL
  • A policy page that never names the SDKs or ad networks the app ships
  • No deletion or consent-withdrawal section
  • Link in App Store Connect but nowhere inside the app

What a passing page contains

Apple reviews against the text of the guideline, so the fastest resubmission mirrors it: collection, uses, third parties, retention, deletion. A page that states those five things in plain words passes; length does not matter.

Get the privacy policy URL for your app (free)Learn more

FAQ

What does a Guideline 5.1.1 rejection mean?

Your app failed Apple's Legal, Privacy, Data Collection and Storage rules. Sub-point (i) is the privacy policy link: it must be in the App Store Connect metadata field and inside the app, and the page must cover collection, uses, third parties, retention and deletion.

Can I just add the link in App Store Connect and resubmit?

Only if the app also links to it in an easily accessible place. The guideline requires both. Add a Privacy Policy row to settings or about, then resubmit.

Does the policy have to mention third-party SDKs?

Yes. 5.1.1(i) asks the policy to confirm that any third party with whom the app shares user data, such as analytics tools, advertising networks and third-party SDKs, provides the same or equal protection.

Is the hosted URL free for an iOS app?

Yes. Mobile App is on the free path; websites, stores and ad landers use the paid plan.

Related

Sources