Guideline 5.1.2 now names third-party AI explicitly

Who this catches

Any app that takes something a user wrote, photographed, recorded or uploaded and sends it to a model API you do not operate. In practice that is a very large share of apps shipped in the last two years — and most of them were architected before this language was in the guidelines.

The pattern that fails: a text field, a call to a model provider, no consent step, and a privacy policy that mentions "service providers" in general terms. That is disclosure by implication. The guideline asks for clear disclosure and explicit permission.

What "explicit permission" implies

Apple does not prescribe a UI. But "explicit" rules out some common patterns:

• Consent buried in a terms-of-service acceptance at signup, with no mention of AI processing
• A privacy policy link with no in-app disclosure at the point data is shared
• Opt-out defaults, where the user is sending data to a third party unless they find the setting

The defensible shape is a disclosure the user actually sees, naming that data goes to a third party for AI processing, with an affirmative action before it happens.

It interacts with your privacy manifest

Data shared with a third-party AI provider is still collected data. If your app collects it, it belongs in NSPrivacyCollectedDataTypes in your privacy manifest, and in your App Privacy answers in App Store Connect. Teams that add an AI feature late in a release cycle routinely update the code and forget both.

Why this is under-covered

Searching for guidance on this returns almost nothing, because the language is recent and the developer content ecosystem has not caught up. That does not make it unenforced. It makes it a rejection you will not see coming — which is the expensive kind.