Rejected under 5.1.2(i)? How to add AI data consent to an Expo app

Why AI apps started getting this rejection

Apple added the words “including with third-party AI” to guideline 5.1.2(i) in the App Review Guidelines update announced on November 13, 2025. Since then, apps that send prompts, photos, voice or documents to a model provider without asking first have been rejected with a message like this one, quoted by a developer on the Apple Developer Forums:

The app appears to share the user’s personal data with a third-party AI service but the app does not clearly explain what data is sent, identify who the data is sent to, and ask the user’s permission before sharing the data.

That sentence is effectively the checklist. The reviewer wants to see three things inside the app: what is sent, who receives it, and a permission step that happens before anything is sent.

AI app builders make it easy to wire a chat or photo feature straight to an AI API, and a consent step is easy to leave out when the goal is a working preview. That gap is what 5.1.2(i) now catches.

The fix in an Expo app

1. A consent screen that names the provider

Show it at onboarding or right before the first AI feature is used. It should say, in plain words:

• which provider receives the data, for example “OpenAI”,
• what is sent: messages, photos, audio, documents,
• what it’s used for, with a link to your privacy policy,
• two clear choices, Allow and Don’t allow, with nothing pre-selected.

Apple publishes no template for this screen. The wording above mirrors what its rejection messages ask for.

2. Store the choice, and check it where the request is made

The most common reason for a second rejection is that the reviewer never saw the prompt. In one forum thread the gate had an && where it needed ||, so the prompt never appeared. Check consent inside the function that calls the AI, not only in navigation, so there is no path that skips it.

import * as SecureStore from "expo-secure-store";

const KEY = "ai-consent-v1"; // bump the version if the provider or data changes

export const hasAiConsent = async () => (await SecureStore.getItemAsync(KEY)) === "granted";
export const setAiConsent = (granted: boolean) =>
  granted ? SecureStore.setItemAsync(KEY, "granted") : SecureStore.deleteItemAsync(KEY);

export async function askAssistant(prompt: string) {
  if (!(await hasAiConsent())) throw new Error("AI_CONSENT_REQUIRED"); // show the consent screen
  return fetch("https://your-api.example.com/assistant", { method: "POST", body: JSON.stringify({ prompt }) });
}

expo-secure-store keeps values in the iOS Keychain, which can survive an uninstall. Test the prompt on a clean device or simulator so you see what a reviewer sees. AsyncStorage works too for a flag like this.

3. Let people withdraw consent

Guideline 5.1.1(ii) asks for “an easily accessible and understandable way to withdraw consent.” A toggle in Settings that calls setAiConsent(false) covers it.

4. Update the privacy policy and the App Privacy details

Name the AI provider in your privacy policy, say what data it receives and why, and explain how to withdraw consent or ask for deletion. In App Store Connect, review the App Privacy answers for the data types the AI feature handles, such as user content, photos or audio.

5. Tell the reviewer where to look

In App Review Information, add one line saying where the consent prompt appears, for example “The AI consent screen appears the first time you open the Chat tab.” It saves a round trip.

How we handle it

In an audit we trace every place the app sends data off the device, list which ones reach an AI provider, and check that each one passes through the consent gate. The fix itself is usually small. What takes care is making sure no path skips it, including features the builder generated and nobody tested.