App rejected for its privacy policy? How to fix it

Apple App Store: Guideline 5.1.1(i) — Privacy Policies

“All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner.”

Official source · checked 2026-10-30

Common causes

• No privacy policy link inside the app (only in App Store Connect).
• The policy does not say what data is collected, how, and every use of it.
• Third-party SDKs (analytics, ads) are not covered.
• No retention/deletion section or no way to revoke consent and request deletion.
• The App Privacy “nutrition label” contradicts the policy.

Google Play: User Data policy

“Please make sure your privacy policy is available on an active, publicly accessible and non-geofenced URL (no PDFs) and is non-editable.”

Official source · checked 2026-10-30

Common causes

• The URL is a PDF, a Google Doc that can be edited, needs a login, or is geoblocked.
• The link is missing from the store listing or from inside the app.
• The Data safety form does not match the policy or the SDKs in the app.
• No way to request account and data deletion.

Chrome Web Store: Program Policies — Privacy Policies

“If your Product handles any user data, then you must post an accurate and up to date privacy policy.”

Official source · checked 2026-10-30

Common causes

• Privacy policy field in the Developer Dashboard is empty.
• The extension reads browsing data, page content or identity but the policy does not say so.
• The data use certifications (Limited Use) are not reflected in the policy.

Meta (Facebook Login): Platform Terms — 4. Privacy Policy

“You will provide, maintain, and comply with a privacy policy that is available through an active, publicly available, easily accessible (including by our crawlers), and non-geoblocked URL.”

Official source · checked 2026-10-30

Common causes

• Meta’s crawler can’t load the URL (login wall, bot protection, redirect, geoblock).
• The URL is missing from the App Dashboard privacy policy field.
• The policy does not explain how users request deletion of their data.

Fix checklist before you resubmit

1. Host the policy at a public HTTPS URL: no login, no PDF, no geoblocking, no editable doc.
2. Open the URL in a private window and from a different country or network to confirm it loads.
3. Put the same URL in the store console field and link it inside the app or extension.
4. List every type of data you collect, how you collect it and every use.
5. Name the third-party SDKs and services (analytics, ads, crash reporting, login, payments).
6. Explain retention, deletion and how users revoke consent or request deletion.
7. Make your store privacy forms (App Privacy, Data safety, Chrome certifications) match the policy.
8. Reply to the reviewer with what you changed and where the link is.

FAQ