App Review Guidelines October 2026 changes: what 1.2, 2.3.14, 2.5.19 and 3.1.1(a) mean for your app

The App Review Guidelines October 2026 changes were announced in Apple's Updated App Review Guidelines are now available post on October 16, 2026. Two guidelines are new (2.3.14 and 2.5.19), three passages were reworded (1.2, 3.1.1(a) and section 5), and the Before You Submit and After You Submit sections gained links to more documentation. Below is each change in plain English, who has to act, and a checklist for your next submission.

What changed in the App Review Guidelines on October 16, 2026?

Apple added guideline 2.3.14 for creative assets and guideline 2.5.19 for hidden features. It also clarified 1.2 (user-generated content), 3.1.1(a) (external purchase links) and section 5 (Legal). Apple's changelog lists the edits like this:

Apple says translations "will be available on the Apple Developer website within one month." As of October 2026, check the English App Review Guidelines whenever a translated copy disagrees with it.

What does the new guideline 2.5.19 on hidden features require?

Guideline 2.5.19 requires that every feature in your binary be visible and documented to both users and App Review. Hiding functionality, including through obfuscation, can get the app removed and the developer account terminated.

The exact text: "Don't include any hidden, dormant, or undocumented features in your app; your app's functionality should be clear to end users and App Review. Attempting to hide undocumented features in your app binary, such as through code obfuscation or other methods, is grounds for removal of your app from the App Store and termination of your developer account." Apple describes the policy as long-standing, but it used to sit in 2.3.1. The current 2.3.1(a) still requires that new features be "described with specificity in the Notes for Review section". Hidden-feature rejections should now cite 2.5.19 instead.

In practice, list in your review notes every feature that a server switch, an invite code, a QR scan, a region or an account tier can turn on. If a flag will enable a feature after approval, either turn it on in the reviewed build or leave the code out until the version that ships it.

Which apps are affected by the guideline 1.2 changes?

Guideline 1.2 now covers any app that lets users "create, generate, upload, share, or otherwise contribute content", and names social media, UGC platforms and AI content creation apps. Those apps must filter objectionable material, offer reporting with timely responses, let users block abusive users and publish contact information.

The revised text lists "nonconsensual intimate imagery" alongside IP infringement and bullying. It adds: "Developers who fail to implement appropriate safeguards or fail to remediate identified violations after notice may be considered in violation of the Developer Code of Conduct." If an AI image or avatar app only generates content for the user, it can now still be in scope. Prompt and output filtering, reporting and published contact details belong in the build you submit, not on a roadmap.

What does guideline 2.3.14 say about creative assets?

Guideline 2.3.14 says creative assets must relate to your app's content, functionality or brand, follow the normal metadata rules and be appropriate for all audiences. It bans inappropriate content, misleading references to other apps, unverifiable claims and "specific or discounted pricing information".

Creative assets are the image and video assets Apple introduced on October 5, 2026. According to Apple's App Store asset best practices, they appear "in iOS 27 and iPadOS 27 and later including your product page, in search results, and when your app is featured." The same page goes further than the guideline. It says to leave out website URLs, copyright symbols, logos of other platforms and Apple recognitions such as "Editor's Choice". It also says assets "must meet a 4+ age rating, even if your app's rating is higher". A header that reads "50% off this week" or "#1 budget app" breaks 2.3.14.

What changed in guideline 3.1.1(a) external purchase links?

Guideline 3.1.1(a) no longer has a separate Music Streaming Services Entitlement bullet. That entitlement now sits inside the StoreKit External Purchase Link Entitlements bullet, and the text says links may go to "a permitted destination". Approved destinations may vary by region.

The rules on where links are allowed did not change in this update. The entitlements are still limited to specific storefronts. The United States storefront is still the exception where buttons, external links and other calls to action are allowed without an entitlement. If you already use either entitlement, check that your link still lands on a destination that is permitted in each storefront you ship to.

How do developers fix hidden-feature and UGC rejections in practice?

Publicly reported cases show that rejections under the old 2.3.1 hidden-feature wording and under 1.2 were usually resolved by making every feature and safeguard easy for the reviewer to find, or by appealing. Code changes alone rarely fixed them.

• In March 2026 a developer on the Apple Developer Forums reported that a native social alarm app had been rejected under "Guideline 2.3.1(a) - Hidden Features" and 4.2. They said WebViews were used only for the privacy policy, terms and FAQ, and they appealed. App Review replied that the App Review Board had responded. The developer then asked for the specific screens involved, and no fix was posted.
• In a Flutter GitHub issue, several developers were told "We discovered that your app contains hidden features" for simple apps. A Flutter contributor called the framework "a red herring" and pointed to undocumented APIs in app code or plugins. Two developers reported approval after appealing, without changing their code.
• A developer on the Apple Developer Forums was rejected under 1.2 despite having an EULA, filtering, reporting and blocking. They were asked to agree terms with "no tolerance for objectionable content" and to "act on objectionable content reports within 24 hours". A second rejection added an 18+ age rating, instant post removal and in-app contact information. They responded by documenting every safeguard and providing admin credentials in the review notes.

Takeaway: In all three cases, reviewers could not see or verify features the developers believed were obvious. Under 2.5.19 and the stricter 1.2, the review notes and demo account do as much work as the code. Our App Store review demo account guide covers how to set those up.

What should you check before your next submission?

Before your next build, check feature flags, UGC safeguards, creative assets and external links against the new text, then write review notes that point to each one. The checklist below covers the October 2026 changes.

1. List every server-controlled flag, remote config key and hidden menu. Turn each one on for the reviewer, or remove the code it controls.
2. Describe each new feature with specificity in Notes for Review, as 2.3.1(a) requires, including how to reach anything behind invites, scans or paid tiers.
3. If users can post, chat or generate content, confirm filtering, reporting, blocking and published contact info are all in the build, and write down your process for acting on reports.
4. For AI image or video generation, add prompt and output filters that block sexual imagery of real people, and give users a way to report outputs.
5. Check every creative asset for prices, discounts, URLs, award claims, other platforms' logos and anything above a 4+ rating.
6. If you use an external purchase link or music streaming entitlement, confirm the link goes to a permitted destination in each storefront.
7. Re-read the English guidelines for any section you rely on, because translations may lag by up to a month.

Worked example: take an AI avatar app with a public gallery and a "Pro" style pack switched on by remote config after launch. Under the new text it needs gallery moderation and reporting (1.2). The Pro pack must either be visible in the reviewed build or held back until a later version (2.5.19). Its iOS 27 header asset cannot say "Pro now 40% off" (2.3.14). If you are already dealing with a rejection, our guideline-by-guideline fix guide explains how to reply in App Store Connect. For a second pair of eyes before you submit, see our services.