On November 13, 2025, Apple introduced what may be the most significant privacy update to its App Review Guidelines in years. Buried in the revision to guideline 5.1.2(i) is a single sentence that will fundamentally change how iOS developers integrate AI features: "You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so."
For the first time, Apple has explicitly named third-party AI as a category requiring special disclosure and consent. If your app sends user data to OpenAI, Google's Gemini, Anthropic's Claude, or any other external AI service, you now face strict compliance requirements that go far beyond standard privacy policies.
Why This Matters Now
While rule 5.1.2(i) has always required disclosure and consent for data sharing, the explicit mention of third-party AI reflects the platform's recognition that AI data flows present unique privacy risks that deserve special attention.
This change arrives as Apple prepares its own AI-enhanced Siri for 2026, reportedly powered partly by Google's Gemini technology. By establishing clear rules for how competitors handle AI data sharing, Apple is positioning itself as a privacy guardian while simultaneously preparing to launch its own AI features.
What Counts as Third-Party AI
Apple's guidelines do not provide a precise definition of "third-party AI," which means developers must interpret the requirement broadly. Based on the language and intent of the guideline, third-party AI includes:
Large language models: Any service that processes text through models like GPT, Claude, Gemini, Llama, or similar systems. This includes chatbots, writing assistants, code completion tools, and text generation features.
Generative AI systems: Image generation services, audio synthesis, video creation tools, and any application that uses AI to create new content based on user input.
Machine learning platforms: Cloud-based ML services that process user data for predictions, classifications, recommendations, or pattern recognition. This includes services from AWS, Google Cloud, Azure, and specialized ML providers.
AI-powered analysis tools: Systems that use AI to analyze documents, images, audio, or video.
Voice and speech processing: Transcription services, voice synthesis, speaker identification, and natural language understanding systems that operate in the cloud.
The key distinction is whether the AI processing happens on-device or through an external service. On-device AI using Apple's Core ML or similar frameworks does not require the special disclosure, as no data leaves the user's device. However, any data transmission to a third-party AI provider—even for brief processing before returning results—triggers the new requirements.
Technical Implementation Requirements
Apple's guideline creates three non-negotiable requirements that developers must implement before submitting apps or updates.
Requirement 1: Explicit Disclosure
You must clearly inform users that their personal data will be shared with third-party AI services. This disclosure cannot be hidden in general terms of service or privacy policies. Instead, it must be presented in a way that ensures users understand what is happening with their data.
The disclosure must identify the AI provider by name. Generic language like "we may share data with service providers" is insufficient. Users need to know whether their data is going to OpenAI, Google, Anthropic, or another specific provider.
The disclosure must explain the purpose of the data sharing. Users should understand why their data is being sent to the AI service and what the AI will do with it. For example, "Your message will be sent to OpenAI's GPT-4 service to generate a response" provides clear information about the data flow and purpose.
Requirement 2: Explicit Permission
Users must grant explicit permission before any personal data is transmitted to third-party AI services. This means implementing a consent mechanism that gives users a clear choice to opt in or opt out of AI features that involve external data sharing.
The consent request must appear before the first data transmission occurs. You cannot collect data, send it to an AI service, and then ask for permission retroactively. The permission request must precede any data flow to external AI providers.
Consent cannot be bundled with other permissions. You cannot obtain blanket approval through general privacy policies or account creation flows. Each category of AI data sharing requires specific user acknowledgment. If your app uses AI for both text analysis and image generation, users must understand and consent to both types of data sharing separately.
Users must be able to decline without losing core app functionality.
Requirement 3: User Control
Once users have granted permission, they must retain ongoing control over AI data sharing. This means providing settings that allow users to review their consent choices and revoke permission if they choose.
Your app should include clear settings that show which AI features are enabled, which providers receive data, and options to disable specific AI integrations. This transparency helps users maintain control over their personal information throughout their relationship with your app.
Practical Implementation Patterns
Based on the guideline requirements and industry best practices, here are specific implementation patterns that will satisfy Apple's review process.
Pattern 1: First-Use Consent Dialog
When a user first attempts to use an AI-powered feature, present a modal dialog that explains the data sharing and requests permission.
Clear action buttons that allow users to proceed with permission or decline. Avoid dark patterns that make declining difficult or confusing.
Pattern 2: Settings-Based Consent Management
For apps with multiple AI features or providers, implement a dedicated settings section for AI data sharing controls.
Pattern 3: In-Context Consent
For AI features that appear in specific workflows, request consent at the moment the feature is relevant. For example:
When a user taps a "Generate with AI" button, show a consent sheet before processing begins.
What Triggers the Requirement
Not every AI feature requires the special disclosure and consent mechanisms. Understanding which scenarios trigger the requirement helps developers implement compliance efficiently.
Triggers the requirement:
Sending user messages, prompts, or queries to external LLM APIs.
Uploading user documents, images, or files to cloud-based AI services for analysis or processing.
Transmitting voice recordings or audio to external transcription or speech recognition services.
Sharing user preferences, behavior data, or usage patterns with AI recommendation engines.
Sending user-generated content to external AI moderation services.
Any scenario where identifiable user data leaves the device and is processed by a third-party AI system.
Might not trigger the requirement:
On-device AI processing using Core ML, Create ML, or similar frameworks where data never leaves the device.
AI processing performed by first-party services that you own and operate, provided users understand this in your privacy policy.
Public API requests to AI services that do not include any personal user data.
Privacy Policy Updates
In addition to in-app consent mechanisms, developers must update their privacy policies to reflect AI data sharing practices.
Conclusion
Apple's update to guideline 5.1.2(i) represents a watershed moment in mobile AI privacy. For the first time, a major platform has explicitly required disclosure and consent for third-party AI data sharing. The guideline is effective immediately.
Top comments (1)
Triggers the requirement:
Sending user messages, prompts, or queries to external LLM APIs.
Uploading user documents, images, or files to cloud-based AI services for analysis or processing.
Transmitting voice recordings or audio to external transcription or speech recognition services.
Sharing user preferences, behavior data, or usage patterns with AI recommendation engines.
Sending user-generated content to external AI moderation services.