Rejection decoder › Guideline 5.1.1 data collection

Guideline 5.1.1 rejection: data collection and purpose strings

Guideline 5.1.1 covers what data an app collects and how it asks. For wrapped apps the usual trigger is a permission prompt: a camera, photo, location or microphone request whose explanation text is missing, vague, or shown before the user has any reason to allow it.

What Apple's message says

Apple cites a sub-part. Paraphrased:

• 5.1.1(i): the app has no privacy policy link, or the policy does not say what is collected, how, and how to ask for deletion.
• 5.1.1(ii): the purpose string does not clearly explain why the app needs the permission. Apple wants a specific use, often with an example, not "This app needs camera access."
• 5.1.1(iii): the app asks for data it does not need for its core function.
• 5.1.1(iv): the app pushes people to allow access, for example a custom screen with only a "Continue" button before the system prompt, or it stops working when the user says no.
• 5.1.1(v) registration: the app requires an account for features that do not need one. Account deletion is covered on its own page.

A related upload email, ITMS-90683 Missing purpose string in Info.plist, means a framework in the build references a protected API and the matching key is missing. Without the key, the app can crash when that API is used.

Why AI-built apps hit it

Capacitor plugins add native abilities, but they do not write your permission texts:

• The Camera plugin is installed for a profile photo, and NSCameraUsageDescription, NSPhotoLibraryUsageDescription and NSPhotoLibraryAddUsageDescription are missing or copied from a tutorial ("We need your camera").
• A location plugin is added "in case", so the app asks for location at launch with no location feature visible.
• Notification, tracking and camera prompts all appear on first launch, before sign-up.
• The web app's sign-up wall is kept, so browsing public content requires an account.
• The privacy policy is a generated template that names data the app does not collect and misses what it does.

How to fix it, step by step

What to reply in the Resolution Center

Fill in the brackets and delete anything you did not do. Quote the new purpose string so the reviewer does not have to find it.

Hello,

Thank you. In build [version], we updated the [camera / location / photo library] purpose string to: "[exact text]". The permission is now requested only when the user [action, e.g. "taps Add photo on the entry screen"], and the app continues to work if the user declines. [We removed the (location) permission, which the app did not need.]

Best regards,
[Your name]

Related guidelines

• Guideline 5.1.1(v): Account deletion for the account deletion part of the same guideline.
• Guideline 5.1.2 / ITMS-91053: Privacy manifest because data you collect is also declared in the privacy manifest.
• Guideline 4.2: Minimum functionality because camera and photo features are often added to address 4.2, and then need purpose strings.

Questions

What should NSCameraUsageDescription say?

One specific sentence about what your app does with the camera, ideally with an example, such as "Take a photo of a receipt to attach it to an expense." Generic text like "This app needs the camera" is a common reason for a 5.1.1 rejection.

What does ITMS-90683 Missing purpose string mean?

Your build, or a framework in it, references a protected API such as the camera or location, and the matching usage description key is missing from Info.plist. Add the key with a real explanation, or remove the plugin that references the API.

Can I show my own screen before the system permission prompt?

A short explanation is generally fine, as long as the user can continue without granting access and the button does not pressure them. A screen with only an "Allow" or "Continue" option that leads straight to the prompt is a common 5.1.1(iv) finding.