App Store Guideline 5.1.2 Rejection: Fix Tracking Prompts

What Guideline 5.1.2 actually checks

Guideline 5.1.2 is titled "Data Use and Sharing" and sits under "Legal, Privacy" in the App Store Review Guidelines. Most rejections come from 5.1.2(i). It says: "You must receive explicit permission from users via the App Tracking Transparency APIs to track their activity." It also says your app "may not require users to enable system functionalities (such as push notifications, location services, tracking) in order to access functionality, content, use the app, or receive monetary or other compensation, including but not limited to gift cards and codes." Apple's definition of tracking is narrow. On its User Privacy and Data Use page, tracking means linking data from your app with data from other companies' apps, websites or offline properties for targeted ads or ad measurement. Sharing data with a data broker counts too. In practice, three things need to match. If they don't, expect a 5.1.2 rejection.

• 1. Your privacy label in App Store Connect. Does it say you collect data "used to track you"?
• 2. Your binary. Does it link AppTrackingTransparency or AdSupport, or include an NSUserTrackingUsageDescription string?
• 3. What the app does. Does a prompt appear? Does tracking start before the answer? Is anything locked until the user says yes?

Why did my app get a 5.1.2 rejection? The usual causes

Read the exact wording of your rejection, then find it in this list.

• Your privacy label says you track, but you don't use ATT to ask permission. What it usually means: the label declares tracking, and the reviewer saw no prompt. The fix: add the prompt, or remove the tracking and update the label.
• Your app collects cookies from web content without using ATT. What it usually means: a web view loads your own site with ad or analytics cookies. The fix: ask through ATT before those cookies are set, or stop setting them in the app.
• Tracking happens after the user chose "Ask App Not to Track". What it usually means: an SDK starts at launch and ignores the answer. The fix: start tracking SDKs only after permission is granted.
• Your app requires or rewards tracking permission. What it usually means: something like "Allow tracking to continue" or a bonus for saying yes. The fix: remove the gate and the reward. Both buttons must lead into the app.
• The reviewer could not find the permission request. What it usually means: the prompt is buried, fires too early, or never appears. The fix: show it at a clear moment and say where in the review notes.
• Your label still says "used for tracking", but your new build doesn't track. What it usually means: something in the binary still points to tracking. The fix: find what links the tracking frameworks, remove it, then update the label.

The label trap: check the binary before you fight the label

That last case is a real trap. In a thread on the Apple Developer Forums, a developer describes weeks of repeated 5.1.2(i) rejections. Their label said "Device ID used for tracking" and App Store Connect wouldn't let them remove it, even though the new build had no NSUserTrackingUsageDescription. An Apple DTS engineer replied that "a third-party SDK might still be silently linking the AdSupport.framework or AppTrackingTransparency.frameworks" and asked which SDKs were in the app. The lesson: check the binary before you fight the label.

First decision: do you need tracking at all?

Make this call before you touch any code. It decides which fix you need. If you aren't running paid campaigns yet, ask yourself whether you need tracking in this version at all. Path B means fewer SDKs to configure and one less prompt in your onboarding.

• You show personalised ads, or measure paid campaigns per user through an ad network or attribution tool. That is tracking. Keep it and add ATT properly (path A below).
• You only use product analytics, crash reports, login and payments. This may not be tracking. But Apple counts an analytics SDK as tracking when it reuses your data for targeted ads in other developers' apps. Check what each SDK collects, turn off advertising ID collection where you can, and declare no tracking (path B).
• You aren't sure what an SDK does. Apple is clear: "Developers are responsible for all code included in their apps." If you can't explain an SDK, contact its developer or remove it.

How to fix an App Store 5.1.2 rejection, path A: keep tracking and ask properly

Use this path if your app really tracks. Follow these steps in order:

• 1. Add the purpose string. Put NSUserTrackingUsageDescription in your Info.plist and write one honest sentence about what the data is used for.
• 2. Ask at the right moment. Call requestTrackingAuthorization when the app is active and on screen. A call made too early during launch can fail to show the prompt.
• 3. Start tracking only after the answer. Ad and attribution SDKs should initialise after the user taps Allow. Apple says that without permission, the advertising identifier "will be all zeros". Don't swap in another identifier: Apple's FAQ says a hashed email or phone number still needs permission through ATT.
• 4. Update your privacy manifest. Set NSPrivacyTracking to true and list your tracking domains in PrivacyInfo.xcprivacy.
• 5. Update the privacy label. Declare each data type you use for tracking.
• 6. Keep any pre-prompt neutral. You can show a screen before the system prompt that explains why you're asking. It can't offer a reward, lock the app, or try to trick people into saying yes.

How to fix an App Store 5.1.2 rejection, path B: remove tracking

Use this path if your app doesn't need tracking. Follow these steps in order:

• 1. Audit every SDK. Check which ones link AdSupport or AppTrackingTransparency. Look at ad, attribution and analytics packages first.
• 2. Remove them, or turn off advertising ID collection where the SDK documents a way to do it.
• 3. Delete NSUserTrackingUsageDescription if nothing asks for permission anymore.
• 4. Set the label to "not used for tracking" and check that the privacy manifest says the same thing.
• 5. If App Store Connect still won't let you change the label, reply to App Review from the rejection message. Explain what you removed and in which build.

Can't find the SDK?

Can't find the SDK, or don't want to dig through the code yourself? Book a free call. It takes 30 minutes and you leave with a fixed quote.

Before you resubmit: a short check

Each new build goes back through review, so run this check yourself first:

• Fresh install on a real iPhone, with Settings, Privacy & Security, Tracking, "Allow Apps to Request to Track" turned on. If that switch is off, the prompt won't appear.
• The prompt shows up once, at the moment you planned.
• Tap "Ask App Not to Track". The whole app still works and nothing is locked.
• No calls to ad or attribution servers before the answer. A network proxy shows this quickly.
• Your privacy label, privacy manifest and the app's behaviour all say the same thing.
• If your app runs on iPad, test the same flow there too.

Write review notes the reviewer can follow

Then write your review notes in plain words. For example: "The tracking permission request appears after account creation, on the second onboarding screen. If the user declines, no advertising SDK is started and every feature stays available."

AI-built and no-code apps: where hidden tracking comes from

Apps made with AI builders and no-code tools often ship with SDKs and web views the founder never chose. A wrapped web app can set ad cookies inside a web view, and that is the "cookies without ATT" case in the list above. If your app started that way, read our guide on why Apple rejects Lovable apps and how to fix it for the wider review problems. If you're fixing your listing at the same time, our guide to Guideline 2.3 misleading metadata rejections covers that part.

When the same rejection keeps coming back

When the same rejection keeps coming back, the problem is often how the build is put together, not the prompt. Our AI prototype to production service starts with an AI-generated code audit and covers authz, secrets and payments, with an "App Store path when you actually need it". You keep the GitHub.

When to bring in a developer

Go back to your diagnosis. Outside help makes sense if:

• The same 5.1.2 rejection came back twice after you changed the label. Something in the binary still says "tracking", and you need someone to find it.
• You can't find the SDK that links AdSupport or AppTrackingTransparency, or you can't tell what each package collects.
• Your platform hides how SDKs start up, so you can't delay them until the user answers.
• You have a launch or investor date and each new review round eats time you don't have.

What does Guideline 5.1.2 Legal Privacy Data Use and Sharing mean?

It covers how your app uses and shares personal data. You need permission before you use, transmit or share someone's data. Tracking needs explicit permission through the ATT prompt. And you can't require or reward that permission.

Does Firebase Analytics require App Tracking Transparency?

It depends on your setup. Apple treats an analytics SDK as tracking when it uses your data for targeted ads or ad measurement with other companies' data. Check what your Firebase configuration collects, especially the advertising identifier. If you turn that off and nothing is used for ads, declare no tracking.

Can I offer a reward for allowing tracking?

No. Guideline 5.1.2(i) forbids making tracking a condition for using the app or for getting "monetary or other compensation, including but not limited to gift cards and codes." A neutral screen that explains the request is allowed.

Do I need the ATT prompt if my app shows no ads?

Only if you track. You still need it if you send user identifiers to an ad network to measure campaigns, or share data with a data broker. If none of your data leaves for those purposes, remove the purpose string and the tracking frameworks, and declare no tracking. Stuck in a rejection loop? Book a call. It's a free 30-minute call. You get a fixed quote before we start, 100% of the code on your own GitHub, and 2 weeks of fixes after launch.