App Privacy Labels and Age Rating: How to Answer App Store Connect's Questionnaires
Before an iOS app can be submitted, App Store Connect makes you answer two questionnaires about it. The App Privacy questionnaire asks, for every category of data your app touches, whether you collect it, whether it is linked to the user's identity, whether it is used to track them across other companies' properties, and what you use it for — the answers become the App Privacy summary shown on your product page. The age rating questionnaire asks about the frequency and intensity of mature content and about capabilities such as chat and user-generated content, and calculates a rating band from your answers. Both are declarations, not settings: getting them wrong is not a mislabel, it is a false statement to Apple, and privacy answers that don't match what the app actually does are one of the most common causes of a Guideline 5.1.1 rejection.
By the AscAuto team — engineers who automate App Store submissions and rejection fixes daily. · Last updated: July 2026
What are App Store privacy nutrition labels?
They are the "App Privacy" section on your App Store product page, generated from what you declare in App Store Connect. Apple groups data into categories — contact info, health and fitness, financial info, location, contacts, user content, browsing and search history, identifiers, purchases, usage data, diagnostics, and a handful of others Apple has added over time — and for each one you answer the same three questions.
Collection means the data leaves the device in a way that you or a partner can access beyond what's needed to service the request in real time. On-device-only processing is not collection.
Linked means it's associated with an identity — an account, a device identifier, anything that ties the record back to a person. Truly anonymised aggregate data is not.
Tracking has a narrow, specific meaning at Apple — see below. If the answer is yes, the AppTrackingTransparency prompt is mandatory.
You then attach purposes to each declared type: app functionality, analytics, product personalisation, developer's advertising, third-party advertising, or other. Purposes are what make the public label readable, and they're also where over-declaring hurts you — a listing that says you collect location for third-party advertising when you don't will scare off installs for no reason.
What counts as tracking
This is the term most teams get wrong, because the everyday meaning is broader than Apple's. Tracking means one of two things:
- Linking data collected in your app with data from other companies' apps, websites or offline properties, for targeted advertising or advertising measurement.
- Sharing data with a data broker.
Analytics you use to improve your own app, crash reports, and measuring your own campaign performance without linking to third-party data are generally not tracking. But if you ship an advertising or attribution SDK, assume it is until you have read what it does.
Your SDKs are your declarations
Apple holds you responsible for everything inside your binary. An analytics SDK that quietly collects an advertising identifier, an attribution SDK that fingerprints devices, an ads SDK that shares with a broker — all of it must appear in your answers, whether or not you knew about it.
Two things make this tractable. First, privacy manifests: SDKs that Apple designates as commonly used are expected to ship a PrivacyInfo.xcprivacy file declaring the data they collect and their reasons for using certain APIs, and Xcode aggregates every manifest in your project into a privacy report. Generate that report and compare it line by line with what you typed into App Store Connect. Second, read the release notes when you bump an SDK version — collection behaviour changes between versions, and your declarations do not update themselves.
How do I fill in the age rating questionnaire?
In App Store Connect, under the app's information, you answer a set of questions about content frequency and intensity — cartoon or realistic violence, sexual content or nudity, profanity, alcohol, tobacco and drug references, simulated gambling, horror themes — and about what the app lets people do: chat with other users, post user-generated content, browse the open web, or access physical goods and services. App Store Connect calculates the band from your answers; you don't pick it directly.
Apple overhauled the bands in July 2025: alongside 4+ and 9+, the questionnaire now maps to 13+, 16+ and 18+, replacing the older 12+ and 17+ ratings, and gained new mandatory questions about in-app controls, app capabilities, medical or wellness content and violent themes. Apple re-rated every existing app automatically from previous answers.
Two practical notes. Rate the app as a whole, including anything reachable through an in-app browser or a user-generated feed — an app with an unmoderated feed is not a 4+ app no matter how gentle your own content is. And remember that the rating affects availability: some regions and Family Sharing behaviours depend on it, so an inflated rating costs you reach while an understated one costs you the review.
The answers that turn into rejections
| What happens | Why it fails |
|---|---|
| Privacy labels say "no data collected", but an analytics or ads SDK ships in the binary | The most common privacy rejection there is. Apple compares declarations against observed behaviour — see Guideline 5.1.1. |
| Tracking declared, no ATT prompt implemented | Automatic rejection; the declaration itself tells the reviewer to look for the prompt. |
| Privacy policy URL missing, broken, or behind a login | Every app needs a publicly reachable privacy policy. A 404 here is enough on its own. |
| Purpose strings that don't explain the purpose ("This app needs camera access") | Purpose strings are reviewed as part of privacy. Say what you do with it and why the user benefits. |
| Account creation without in-app account deletion | A hard requirement, checked in the same pass as the privacy answers. |
| Age rating that ignores chat or user-generated content | Capability questions exist precisely to catch this, and moderation-free social features get rated up. |
How AscAuto handles the questionnaires
When AscAuto checks a version before submission, the questionnaires are part of the readiness scan: it reports which App Privacy answers and age-rating questions are missing or stale on the App Store Connect record, drafts the answers it can support with evidence from your project, and puts each one in front of you to approve. It does not silently answer legal declarations on your behalf — these are statements you are making to Apple, so they stay approval-gated by design, the same way the rest of the submission checklist does.
If a rejection does come back on privacy grounds, that's the loop AscAuto is built for: it reads Apple's message, identifies whether the fix is a declaration change, a purpose string, or code, and prepares the resubmission for your approval.
FAQ
What are App Store privacy nutrition labels?
The App Privacy section of your listing, generated from a questionnaire in App Store Connect. For every data category you declare whether you collect it, whether it's linked to the user's identity, whether it's used to track them across other companies' properties, and what you use it for.
Does my app collect data if the data never leaves the device?
No. Apple defines collection as transmitting data off the device in a way you or a partner can access beyond servicing the request in real time. On-device-only processing isn't collection — but be certain no embedded SDK is sending it on your behalf.
What counts as tracking, and when do I need the ATT prompt?
Linking your app's data with other companies' data for targeted advertising or ad measurement, or sharing data with a data broker. If you do either, you must request permission through AppTrackingTransparency before tracking, and your privacy answers must say so.
Am I responsible for what third-party SDKs collect?
Yes. Your declarations must cover every SDK in the binary. Many SDKs ship a privacy manifest, and Xcode aggregates them into a privacy report — compare it against your answers before you submit.
How does the age rating questionnaire work?
You answer questions about content frequency and intensity plus capabilities like chat and user-generated content, and App Store Connect calculates the band. Apple overhauled the system in July 2025 — 13+, 16+ and 18+ joined 4+ and 9+, replacing 12+ and 17+ — and required every app to complete the new questionnaire by 31 January 2026. Apps that missed it cannot submit updates until they answer it.