Every rejection reason, explained in plain language.

Apps can't host content that's obscene, defamatory, or designed to demean a group of people.

Content that demeans a specific group based on race, religion, gender, or similar traits isn't allowed, even as humor.

Photo-realistic violent imagery has stricter limits than stylized or cartoon violence.

Pornographic content, or material designed mainly to be sexually arousing, isn't allowed on the App Store at all.

Your app's description and functionality can't misrepresent what it actually does.

Apps where users post content need moderation tools, a reporting mechanism, and a way to block abusive users.

Apps built around a single creator's content still need the same moderation standards as any other UGC app.

Apps in the Kids category can't include third-party analytics or advertising SDKs that aren't approved for children.

Apps that give medical advice or dosing information need to come from a credentialed source.

Apps encouraging illegal drug use, or making it look casual and safe, aren't allowed.

Apps can't encourage dangerous stunts, self-harm trends, or other activities likely to cause real injury.

Your support URL, contact info, and developer name have to be accurate and actually reachable.

Apps have to protect user data with reasonable security, and disclose any known data breach.

Apps that become aware of criminal activity endangering a minor have to report it appropriately.

Broken links, placeholder content, or crashes during review will get an app rejected.

Beta or unfinished builds can't be submitted for regular App Store review — that's what TestFlight is for.

Every feature in your app has to be visible and described in your review notes — nothing unlocked later or hidden from reviewers.

The "What's New" release notes have to actually describe what changed in that version.

Anything that costs extra inside your app has to be clearly marked before the user gets to it.

Screenshots have to show your actual app running, not marketing mockups or another platform's UI.

App preview videos have to be actual captured app footage, not staged or heavily edited demos.

The primary category you pick in App Store Connect has to genuinely match what the app does.

The age-rating questionnaire answers have to match what's actually in the app.

Your app name and keywords can't copy another app's, or stuff in unrelated terms to game search.

App name, description, and screenshots have to be appropriate for a general audience, regardless of the app's actual age rating.

If your app runs on iPad, it has to actually work well on iPad, not just be a stretched iPhone layout.

An app that drains the battery abnormally fast for what it does will get flagged.

Apps can only use Apple's public, documented APIs — no private frameworks or undocumented calls.

SiriKit intents and Shortcuts actions have to actually do what their name and description say.

Call-blocking and SMS-filtering extensions can't be used to enable spam or fraud instead of preventing it.

Face ID and other facial recognition data can only be used for on-device authentication, not stored or sent off-device.

Widgets and extensions have to follow the same design and functionality rules as the main app, on their own.

Ads shown on system surfaces like the Lock Screen or Home Screen aren't allowed — ads stay inside your app.

Apps can't download or execute new code after install — everything has to ship in the reviewed binary.

An app can't include code designed to damage, disable, or gain unauthorized access to a user's device.

Background execution modes can only be used for what they're actually designed for.

Digital goods and services must be sold through Apple's In-App Purchase system, not external links.

Apps generally can't link out to a website to buy the same digital content available via In-App Purchase.

Auto-renewable subscriptions need clear terms, price, and length disclosed before purchase.

A handful of specific app types are allowed to use payment methods other than In-App Purchase.

Apps for consuming previously-purchased content, like books or video, can let users view their account without in-app purchase.

Content tied to a specific physical accessory you own can be unlocked without going through In-App Purchase.

Crypto exchange and wallet apps need the right licenses; mining is only allowed off-device via cloud services.

Apple gives a specific list of monetization approaches that are fine — ads, IAP, paid downloads, and more.

Certain monetization patterns are banned outright — fake App Store-like interfaces, ad-impression manipulation, and forced downloads.

Your app can't clone another app's design, or impersonate a brand or another developer.

You can't charge users extra just to access a standard iOS feature that's normally free, like the flashlight.

An app has to do more than wrap a website or repackage content with nothing native added.

Your app has to be a complete, standalone experience, not one piece of a larger unpublished product.

Apps generated from a commercial app-building template need real customization and their own developer submission.

Remote desktop apps can only connect to servers you own or control, or ones with clear user consent.

Apple rejects apps that are too similar to other apps on the Store, including your own.

Custom keyboards can't collect what a user types unless it's disclosed, and need a way to switch back easily.

Apps integrating with Apple Music can't alter how it functions or fail to give it proper attribution.

Apps can't use Apple services like Game Center or iCloud in ways that generate spam for other users.

Push notifications can't be used for ads, marketing blasts, or anything the user didn't opt into.

HTML5 mini-games, streaming game catalogs, and emulators are allowed, but only under specific rules.

If you offer any third-party login option, you generally have to offer Sign in with Apple too.

If you support Apple Pay, it has to work correctly and follow Apple's official Apple Pay marketing guidelines.

Every system permission prompt, for camera, location, or contacts, needs a purpose string explaining why, in plain language.

Apps that support account creation must also support account deletion.

Data you collect can only be used for what you told the user, and can't be sold or repurposed.

Apps handling HealthKit data or running health research studies have extra consent and data-use restrictions.

Apps directed at kids can't collect personal data from them without verifiable parental consent.

Background location access is only allowed when a core feature genuinely can't work without it.

You need the rights to any music, video, images, or content your app displays.

If your app integrates a third-party site, product, or service, you need documented permission to do so.

Apps can't offer a way to download copyrighted audio or video from a source that doesn't allow it.

Contests and sweepstakes run through your app need to be sponsored by you and follow official rules.

Real-money gambling, casino, and lottery apps need proper licensing in every region they operate in.

Apps with account creation need an in-app and web-based account deletion option.

Google requires developer accounts to be genuine, singly-owned, and not created to evade a prior suspension.

Faking ad clicks or impressions — even ones a user never actually saw — is treated as fraud against advertisers, not just a UX problem.

Ads in your app can't be disruptive, disguised as content, or served outside your app's own UI.

Apps built around alcohol, tobacco, or other age-gated products need an actual age screen, not just a rating label.

Apps that generate synthetic media (deepfakes, AI images/voices) need safeguards against misuse and clear labeling.

Apps that extend to Android Auto have extra restrictions around driver distraction — most notably, video and free-text input are off-limits while driving.

Paying people to install your app, or rewarding installs with cash-equivalent value, distorts rankings and isn't allowed.

Crypto exchanges, wallets, and NFT apps have to clearly disclose what they do and follow extra financial-app requirements.

Any content or feature that sexualizes, endangers, or exploits minors results in an immediate app takedown, no warning cycle.

The IARC content rating questionnaire has to match what's actually in your app, not what you wish the rating was.

Your Play Console Data Safety form has to match what your app actually collects.

Your app can't trick users into actions like installs, clicks, or granting permissions.

Apps can't interfere with other apps, download executable code, or degrade device performance.

Apps aimed at children can only use ad SDKs that have self-certified compliance with Google's families ad program.

Apps that opt into or target the Families program face stricter rules on content, ads, data collection, and permissions.

Lending, crypto, and financial apps need extra disclosures and often region-specific licensing.

The app has to work as advertised, without excessive crashes or an essentially empty experience.

Real-money gambling apps are only allowed in specific countries, and only if licensed there.

Apps offering medical or health guidance can't make unsubstantiated claims, especially around serious conditions.

An app whose real purpose is installing other apps — without being clear about it upfront — isn't allowed on Play.

Apps can't help users buy, sell, or coordinate anything illegal in the regions where the app is offered.

Your app, its icon, or its listing can't pass itself off as another company, app, or person.

Content that promotes violence, incites hatred against a protected group, or is gratuitously graphic isn't allowed, even as user-submitted content.

Your app can't use another rights holder's trademarks, characters, or copyrighted assets without permission.

Google auto-scans every app; a false positive here still blocks your submission until resolved.

Your Play Store listing text and images have to accurately represent the app, no keyword stuffing.

Buying reviews, incentivizing five-star ratings, or otherwise gaming your store listing's reputation is a policy violation.

Apps in the News category need to be clearly attributed to a publisher and transparent about what's original reporting versus aggregated content.

Digital goods and in-app content sold inside your app have to go through Google Play's billing system.

Every sensitive permission your app requests has to be justified and disclosed.

Reviews and ratings have to come from real users with genuine opinions, not incentives, bots, or coordinated campaigns.

Content that needs age-gating, extra disclosure, or is disallowed outright.

You're responsible for every SDK you ship, even when the violating behavior comes from the SDK vendor's code, not your own.

Scaring users into believing their device is compromised, to push a download or purchase, is a policy violation regardless of intent.

Google removes near-identical apps, and apps that exist mainly to redirect or upsell elsewhere.

Repeated policy violations accumulate against your developer account, not just the individual app, and escalate toward account termination.

Subscriptions need clear terms and have to use Google Play's billing system for digital content.

An app can't render fake system dialogs, warnings, or settings screens designed to look like they came from Android itself.

Apps have to target a recent Android API level — Google blocks updates to apps that fall too far behind.

Apps that let users post content need a real moderation system, not just a reporting button.

Beyond declaring what you collect, you need a real privacy policy, a legal basis for collection, and safeguards for how the data is stored and shared.

Wear OS apps and tiles are expected to work as standalone, glanceable experiences — not a shrunk-down copy of the phone app.