Apple Guideline 5.1.2(i): third-party AI consent for your app

What does Apple Guideline 5.1.2(i) say about third-party AI?

Your app has a chat box. A user types a question about their health, or their finances, and taps send. Before anyone at OpenAI, Anthropic or Google has that text, Apple wants them to have been told, and to have said yes. The sentence is short:

Apple added the words on November 13, 2025, and described the change as a clarification. It is still there in the guidelines last updated on October 16, 2026. The same guideline warns that apps sharing user data without consent "may be removed from sale and may result in your removal from the Apple Developer Program".

Notice what the rule doesn't do. It doesn't name any provider, define third-party AI, or prescribe a screen. Nor is this a rule about how your app was written: it covers the data your running app sends, whether or not AI wrote the code.

What must apps calling OpenAI, Anthropic or Gemini disclose?

If personal data leaves in the request, disclose where it goes and ask first. Apple doesn't list what counts as personal data in this guideline, so read the request your app really sends. These hypothetical cases show how we'd read it, which is our reading and not Apple's wording:

Routing the call through your own server doesn't change this. The rule asks where the data is shared, and the data still reaches the AI company. If a builder set this up for you, the call may sit in a backend function you've never opened, so check your code or ask the builder which provider it calls.

What should the AI consent screen say?

Say who gets the data, what they get and why, then wait for a tap. Apple publishes no template, so this is our suggestion, built from its wording and the stricter detail in Google's User Data policy:

1. Show it inside the app, before the first request that carries personal data. Not only in your privacy policy.
2. Name the provider, such as OpenAI. "Our partners" doesn't say where the data goes.
3. Say what is sent: your messages, the photo you pick, your workout history.
4. Ask for an action, such as a button labeled Agree or Allow. Google's policy says navigating away doesn't count as consent.
5. Give a way out. Keep the rest of the app working if the person declines, where you can.
6. Let people change their mind in settings, and tell them how to revoke consent in your privacy policy.

Update your privacy policy as well. Guideline 5.1.1(i) says it must identify what data the app collects and all its uses, confirm that third parties with access give the same or equal protection, and explain how a user can revoke consent or request deletion.

What do OpenAI, Anthropic and Google do with that data?

It depends on the provider and the plan, so read the terms for yours before you write the disclosure. This is what each says as of November 2, 2026:

The last row is the one to watch. Google's terms say not to submit sensitive, confidential or personal information to the unpaid tier, and to use only paid services for users in the EEA, Switzerland or the UK. If your app sends personal data to Gemini, use a paid plan.

What goes in the privacy labels for an AI app?

Declare what your app and its partners collect, and treat the label as separate from the consent screen. The label doesn't replace asking. Apple defines collect as transmitting data off the device in a way that lets you or your third-party partners access it for longer than needed to service the request in real time.

• Data processed only on the device isn't collected and needn't be disclosed.
• Data sent to your servers and immediately discarded after the request needn't be disclosed either. Don't assume that covers an AI call, since a provider may retain logs (see the table above).
• In our reading, prompts and uploads fit Apple's User Content type. Health and financial details have their own categories.
• Personal data counts as linked to the user, under Apple's note on data linked to identity.

Apple's privacy details page has no AI-specific guidance, so you apply the general definitions. Check them against the App privacy details page when you fill in the form.

What does Google Play require for AI apps?

Two things: an accurate Data safety form, and in-app reporting if your app generates content with AI.

In the Data safety form, Google says collect means transmitting data off a user's device, and sharing means transferring it to a third party. Sending data to a service provider that processes it on your behalf doesn't need to be disclosed as sharing, but you are still responsible for complete and accurate answers. Your privacy policy must disclose any parties that personal or sensitive data is shared with. When Google's User Data policy calls for a prominent disclosure, it must be in the app, in normal use, not only in a privacy policy, and it needs an affirmative action before you collect the data.

Apple has a similar line. Guideline 1.2 lists AI content creation apps alongside social apps as needing a filter for objectionable material, a way to report content, a way to block abusive users, and published contact details.

Can you add this yourself?

Usually, yes. A consent screen is one screen and one saved choice, and you can ask your builder to add it. Check three things after: the screen appears before the first AI call on a fresh install, declining doesn't send anything, and your policy names the provider. Then work through the rest of the launch checklist. You don't need us for that.