Apple published a set of updates to the App Review Guidelines on October 16, 2026. The changes don’t introduce a brand-new review process, but they sharpen three rules that already existed in spirit — and two of them now carry explicit removal consequences. Here’s what changed, who’s affected, and what to check in your app before your next submission.
What changed
Guideline 1.2 — moderation requirements now explicitly name NCII. Guideline 1.2 covers content moderation for apps with user-generated content. The updated text explicitly includes nonconsensual intimate imagery (NCII) — including imagery generated with AI tools, such as so-called “nudification” apps that produce explicit images of real people without consent — as content apps must proactively prevent and remove. Apple also states that developers who fail to implement adequate safeguards, or who don’t fix violations after being notified, risk violating the Developer Code of Conduct and being removed from the App Store.
Pornographic material has been prohibited on the App Store for a long time, and apps that generate nudity or sexually explicit imagery were already covered. What’s new is that NCII — and AI-generated NCII in particular — is now spelled out as content you must actively keep off your platform, not just content you must remove if someone complains.
Guideline 2.5.19 — bait-and-switch is now a numbered rule. Apple has always rejected apps that misrepresent what they do during review. The new 2.5.19 makes that prohibition explicit for a specific pattern: submitting a clean version to App Review, then changing the app after approval — for example, by enabling features or functionality that weren’t present in the reviewed binary. Apps caught doing this face removal from the App Store and removal from the Apple Developer Program. That’s a stronger consequence than a typical 2.5 rejection, which you could normally fix and resubmit.
Section 5 — removal plus blocking from alternative distribution. Section 5 has always prohibited apps that facilitate human trafficking or the exploitation of children, including child sexual abuse material. The update makes explicit that apps containing such content will be removed from the App Store and blocked from alternative distribution — relevant in regions where alternative app marketplaces are permitted under iOS.
Apple also shared enforcement context: last year it blocked over 150,000 apps with safety issues from reaching customers and terminated over 193,000 developer accounts for fraud and abuse. A recurring pattern, per Apple, is coordinated operations that conceal harmful functionality until after an app is approved — exactly the behavior 2.5.19 now names directly.
Who is affected
Any app with user-generated content. Social apps, messaging apps, forums, image-sharing features, comment systems, AI image generators with open prompts — if users can post or produce content others see, Guideline 1.2 now applies to you with NCII explicitly in scope. AI generation features deserve particular attention, because AI-generated NCII is now called out by name.
Apps using remote feature flags or server-driven behavior. If your app changes meaningfully after approval — toggling features on via remote config, downloading new functionality, or revealing capabilities only under certain conditions — you’re in the territory 2.5.19 addresses. This applies even if the post-approval behavior isn’t malicious; if a reviewed version doesn’t match the shipped one, you’re exposed.
Everyone else. If your app doesn’t host UGC and doesn’t alter behavior after review, these changes mostly confirm rules you already follow. The practical impact is minimal — but it’s a good moment to re-read 1.2 and 2.5.19 so your team knows the stakes if a moderation gap ever surfaces.
What you need to do
-
Audit your moderation pipeline. If your app has UGC, verify that filtering catches NCII — including AI-generated imagery. Apple’s guideline says apps must proactively prevent and remove it, so reactive-only moderation (acting only after reports) is no longer a defensible posture.
-
Confirm the three UGC mechanisms exist and work. Apple’s long-standing UGC requirements — filtering objectionable content, a way for users to report offensive content, and a way to block abusive accounts — are now part of the same enforcement story as 1.2. Test each one in your current build, not just in your documentation.
-
Add NCII handling to your report-and-response flow. When a user reports explicit imagery, your team needs a path to remove it and, where appropriate, act on the account. Apple’s language about failing to “remedy violations after notice” means that if Apple flags your app, a fast, documented response is part of staying in good standing.
-
Review what ships after approval. Compare your reviewed binary against what you currently serve: remote config values, feature flags, server-side UI changes, staged rollouts. Anything that materially changes app behavior post-approval should either be described in your App Review notes or removed. Include such functionality in review and document it — surprises are the risk factor here.
-
Tighten your App Review notes if behavior varies. If legitimate reasons exist for server-driven behavior (regional features, phased launches), say so in the review notes so reviewers see the full picture of what the app can do.
-
Re-check your submission before your next release. These guideline updates are in effect now. There’s no migration window to wait for — the next app you submit is reviewed against the updated guidelines.
Key dates
- October 16, 2026 — Apple published the updated App Review Guidelines (changes to 1.2, 2.5.19, and Section 5).
FAQ
Does guideline 1.2 apply to AI-generated content?
Yes — explicitly. The updated 1.2 names nonconsensual intimate imagery “including imagery generated using AI tools” as content apps must proactively prevent and remove. If your app generates images from user prompts, your moderation needs to account for attempts to create explicit imagery of real people, not just filter uploaded photos.
What exactly counts as bait-and-switch under 2.5.19?
Misrepresenting what your app does during App Review, then changing it after approval — Apple’s example is adding features or functionality that weren’t in the submitted version. Legitimate post-approval updates are normal; the rule targets apps whose approved form doesn’t reflect what the app actually becomes. The consequence is removal from the App Store and removal from the Apple Developer Program, so treat it as far more serious than a standard rejection.
My app has user-generated content but heavy moderation already. Do I need to change anything?
You likely already meet most of 1.2, but verify three things: your filtering explicitly covers NCII (including AI-generated), users can both report content and block abusive accounts, and you can act on Apple’s notice quickly if a violation is flagged. The updated guideline shifts the emphasis from “remove when caught” to “prevent proactively,” so documenting your safeguards is worth doing now.
The full updated text lives in the App Review Guidelines on Apple’s developer site. If you’re planning a submission in the next few weeks, read 1.2 and 2.5.19 directly — they’re short, and both now carry consequences that go beyond a rejected build.