This document covers the platform-mechanics and newer-policy gaps that sit alongside the legal layer (EU-REGULATORY-2026.md, GLOBAL-REGULATORY-2026.md) and the base rejection maps. These are current, common, and blocking causes that the base playbook did not carry. Every item is dated and sourced. Several dates and versions move, so re-verify against the cited source before relying on a figure. Items that could not be confirmed against a primary source are labelled unverified in the last section.
An app distributed with a Developer ID (not through the Mac App Store) must be notarized or Gatekeeper blocks it. The four steps. build with every executable and dylib signed. sign with a Developer ID certificate plus a secure timestamp and the hardened runtime. submit with xcrun notarytool and wait for the ticket. staple with xcrun stapler. A bare executable cannot be notarized. it is wrapped in a ZIP, DMG, or PKG container first.
codesign --options runtime --timestamp -s "Developer ID Application: NAME (TEAMID)" <App> (the --options runtime flag is the hardened runtime, --timestamp is the secure timestamp).xcrun notarytool submit <container> --apple-id ... --team-id TEAMID --password <app-specific-password> --wait, then xcrun stapler staple <App>.Sources. Apple notarizing macOS software, Apple Developer ID, Apple customizing the notarization workflow.
Sources. Apple App Review Guidelines, Apple 8 June 2026 guideline update, 4.3(b) clarified with examples, MacRumors on the 4.3 saturation tightening.
A reader app provides magazines, newspapers, books, audio, music, or video as its primary function. The optional External Link Account Entitlement lets it include one informational link to a developer-owned site to create or manage an account. Conditions to qualify. the eligible content is the primary function. sign-in to an externally-created account. access to previously purchased content when signed in. NO in-app purchase offered while the entitlement is used. no real-time person-to-person services (tutoring, medical, fitness). Link rules, all required. links to a site you own. opens the default browser in a new window, not a web view. https scheme with no query or extra URL parameters. no redirects. defined statically in Info.plist before submission. shown once per page with standard HTML styling. Entitlement identifier com.apple.developer.storekit.external-link.account (iOS 16 or later). earlier OS uses Apple’s exact modal sheet.
Source. Apple reader apps.
Apple’s export-compliance documentation matrix.
| Encryption in use | Documentation required |
|---|---|
| Apple OS crypto only | none in App Store Connect |
| An industry-standard algorithm not provided by Apple’s OS | upload a French encryption declaration in App Store Connect, if distributing in France |
| A proprietary algorithm not accepted by IEEE, IETF, or ITU | upload both a US CCATS and the French encryption declaration |
The French declaration is required only when distributing on the French App Store, uploaded in App Store Connect, and the authority is ANSSI. Banking and Medical apps are exempt. ITSAppUsesNonExemptEncryption in Info.plist avoids re-answering the encryption question each submission. Note. the US annual self-classification report to BIS is an EAR obligation, not an App Store Connect field, so it is an external legal item to track, not a store check.
Source. Apple export compliance documentation for encryption.
App Store Connect asks, before each submission, whether the app contains, shows, or accesses third-party content. If yes, the developer must hold the rights under the laws of each country the app is available in, and must be able to provide proof of rights to Apple (attach supporting documents in App Review notes). Source. Apple App Information reference.
Sources. Apple submit visionOS apps, Apple SDK minimums 28 April 2026, Apple submissions open for the 27 OS family, April 2027 SDK floor, App Store Connect screenshot specifications, App Store Connect release notes.
allowed-regions entitlement array must match the entitlement Apple granted (EU, and South Korea for external purchase, plus the separate US external-link path). Check the presence and configuration of the entitlement, not the fee math, which is fluid.Sources. Apple In-App Events, Apple Custom Product Pages, Apple StoreKit external purchase.
Deadline ID APPLE-IPHONE-DUO-LAUNCH, tracked in issue #724. iPhone Duo has a 5.4 inch outer display and a 7.6 inch inner display joined by a hinge, a front camera on each, and launches on iOS 27.1. Pre-orders open 16 October 2026 and it ships 23 October 2026. Apple does not require a Duo rebuild to stay on the store, but an app that ignores the form factor looks broken on it.
userInterfaceIdiom or UIInterfaceOrientation for layout decisions, and not to size views from fixed iPhone dimensions or screen dimensions.ReservedRegion from the geometry proxy in SwiftUI or the view in UIKit and move content clear of them. ArrangementView (SwiftUI) and UIArrangementViewController (UIKit) lay out a primary and secondary view around the fold.NavigationStack, NavigationSplitView, or a navigation controller get this. A hand-built UIToolbar, UINavigationBar, or UITabBar does not. A toolbar item with a title and no icon, or with a custom view, is never shown vertically, so give every item both an icon and a title.Sources. Apple Newsroom, iPhone Duo announcement, Preparing your app for iPhone Duo, Designing for iPhone Duo (HIG), Get ready for iPhone Duo, Prepare and submit your apps for iPhone Duo, 5 October 2026, App Store Connect release notes, Screenshot specifications.
A device-level service checks whether an installed app is registered to a verified developer identity, for all Android apps on certified devices, including sideloaded and alternative-store apps, not only Play Store apps. Timeline. verification opened to all developers in March 2026. the verifier service began auto-installing on devices in June 2026. registration by a verified developer becomes required to install or update apps on certified devices in Brazil, Indonesia, Singapore, and Thailand from 30 September 2026, with participating stores including Google Play, Samsung, Xiaomi, and others. global rollout follows in 2027. A student or hobbyist can use a limited distribution account to share to up to 20 devices without a government ID or fee. Consequence. after the deadline in a participating country, an app from an unverified developer cannot be installed or updated on certified devices through participating stores.
Sources. Android developer verification, Android verification rolling out to all developers.
An app targeting API 34 or later that runs a foreground service must declare android:foregroundServiceType in the manifest AND hold the matching FOREGROUND_SERVICE_* permission. a missing permission throws a runtime exception and the service cannot start. Separately, the Play Console requires a foreground-service-types declaration on the App content page for each type, including a description, the user impact if deferred, a demo video, and a mapped use case. a missing Play declaration is an update rejection under the Device and Network Abuse policy. Related. USE_FULL_SCREEN_INTENT on API 34 or later is auto-granted only for alarm and calling apps. all others declare it in Play Console or request it at runtime and degrade gracefully.
Sources. Android FGS types required, Play Console FGS declaration.
SafetyNet Attestation is fully shut down (turndown completed 31 January 2025). all attestation and anti-abuse checks must use the Play Integrity API. An app that still calls com.google.android.gms:play-services-safetynet is calling a dead service. Verify the server checks the Play Integrity verdict with requestHash request-binding. Source. Play Integrity API.
By 31 August 2026, all new apps and updates to existing apps must use Play Billing Library version 8 or later (an extension is available on request until 1 November 2026). This is a publishing gate, not a runtime kill switch. an already-published version-7 binary keeps transacting, but no new release, including a security patch, can ship on version 7 after the gate. Version 9 shipped in May 2026, and there is no direct version-7-to-9 jump, so migrate to version 8 first. Verify the com.android.billingclient:billing dependency is at least version 8 before the deadline, and that an app selling digital goods actually uses Play Billing rather than a side payment flow. Source. Android Play Billing deprecation FAQ.
New apps and updates must target Android 16 (API 36) or later from 31 August 2026 (Play Console extension to 1 November 2026), existing apps must target API 35 or later to stay visible to new users on newer devices, Wear OS and Automotive OS must target API 35 or later, TV and XR API 34 or later. Android 17 is API 37, released 16 June 2026, and its Play policy changes land 27 January 2027 (Wear OS, Android TV, and Automotive target API 34 or later), effective 31 August 2025 with an extension window. The 2026 bump to API 36 (Android 16) for new apps and updates, reported for 31 August 2026 with a version-35 minimum for existing apps, is consistent with Google’s yearly release pattern but should be verified live on the target-sdk page before it is written as a fixed date. Verify targetSdkVersion is at least 35 today and plan for at least 36 by the 2026 deadline.
Sources. Android target SDK requirement, Play Console target API help.
The Better Ads Experiences policy bans full-screen interstitials that appear unexpectedly (for example when a user is about to read an article or is mid-task), ads at the start of a content segment or before the app’s loading screen, and full-screen interstitials that cannot be closed after 15 seconds (opt-in and rewarded ads excepted). Allowed. interstitials at a natural transition point (end of a game level or chapter), non-full-screen ads, and genuine opt-in or rewarded ads. Verify no interstitial fires at app launch or mid-task, every interstitial has a close control that works by 15 seconds, and ads do not overlay system controls or the app’s own UI.
Sources. Play Console ads policy, Play Better Ads Experiences.
A health app completes the Health Apps Declaration (the Health Connect declaration form enforcement began in March 2025). A January 2026 tightening added a medical-device labeling system, stricter Health Connect data justifications, and a ban on using age-restricted signals for health profiling. requesting sensitive Health Connect read permissions requires proving the data is necessary to the app’s primary function. Existing health apps migrate to a verified Organization Account by 28 January 2026. an app without regulatory clearance shows the disclaimer that it is not a medical device. Verify the declaration is complete, each Health Connect permission has a core-function justification, the Organization Account is migrated, and the label or disclaimer is correct.
Sources. Play Console Health content and services, Play Console Health Connect permissions.
Sources. Google real-money games approach, Google pauses RMG expansion (NEXT.io), Apple Developer News, “Brazilian betting license requirement for App Store availability” (May 8, 2026).
READ_MEDIA_IMAGES or READ_MEDIA_VIDEO. one-time or limited use uses the Android Photo Picker. full compliance was mandatory from 28 May 2025, and a non-compliant app is subject to removal.QUERY_ALL_PACKAGES (package visibility) and SCHEDULE_EXACT_ALARM or USE_EXACT_ALARM remain declaration-gated permissions that require a justification against an approved use case.Sources. Play Console Photo and Video permissions, Play Console account deletion.
Verify, for a US-facing UGC app. a documented escalation path to file a NCMEC report on actual knowledge, a 1-year preservation policy for the reported content, and a reporting mechanism. Sources. 18 U.S.C. 2258A, Ofcom illegal harms, Council CSA Regulation position.
Sources. Apple App Review Guidelines, Google Play Child Safety Standards.
Neither store hard-rejects for failing WCAG, so this is a medium store risk and a high legal risk (see 3.6 and the European Accessibility Act in the EU doc).
Verify. Apple Accessibility Nutrition Labels populated and not over-claimed, UIAccessibility labels and traits present, and on Android the 48dp targets, content descriptions, and a clean Accessibility Scanner run. Sources. Apple Accessibility Nutrition Labels, Android accessibility testing.
Verify the in-app delete flow deletes data (not deactivate), and that a publicly reachable web deletion URL (returns 200, no login wall) is declared. Sources. Apple offering account deletion, Google Play account deletion.
US sanctions prohibit providing goods or services to blocked persons and embargoed territories. Apple itself settled with OFAC for 466,912 dollars in 2019 for hosting a blocked developer’s apps, and 2025 reporting found sanctioned-linked apps slipping into both stores, so the developer’s own compliance still matters. Verify the developer or entity is not on the OFAC SDN list, and the app’s country availability in App Store Connect and Play Console excludes the embargoed territories (Cuba, Iran, North Korea, and the sanctioned regions of Ukraine). Source. TTP on sanctioned apps in the stores.
Syria is no longer a comprehensively embargoed territory, but it is not unrestricted either. The OFAC Syria sanctions program ended on 1 July 2025 under Executive Order 14312, OFAC then removed the Syrian Sanctions Regulations (31 CFR Part 542), and the State Department rescinded the state sponsor of terrorism designation effective 24 August 2026. Two controls remain. First, 15 CFR 746.9 still requires a Commerce license to export or reexport to Syria any item subject to the EAR, apart from EAR99 food and medicine, with listed license exceptions that include SPP for qualifying EAR99 items and CCD for qualifying consumer communications software. So before making an app available in Syria, document whether it is subject to the EAR, its classification, and the exception or license relied on. Published software can fall outside the EAR under 15 CFR 734.3(b)(3) and 734.7, but encryption needs its own analysis, and being in an app store does not by itself make an app published. Second, the list-based Assad accountability sanctions (31 CFR Part 569) still block designated persons and any entity they own 50 percent or more of, named or not, so screen counterparties and ownership, not only the developer’s own name. Whether Apple or Google serve a Syria storefront is their own decision and separate from US law. Sources. Executive Order 14312, 15 CFR 746.9, 15 CFR 734.7, 31 CFR 569.406, OFAC FAQ 1220, SST rescission, Federal Register 2026-17653.
Federal Title III web-accessibility suits rose about 27 percent in 2025, and mobile-app suits are a growing share, with WCAG 2.1 AA as the de facto court standard, though there is no DOJ Title III technical rule for private businesses. the DOJ Title II final rule (2024) requires state and local government apps to meet WCAG 2.1 AA by 2026 or 2027 by population. Flag WCAG 2.1 AA as a legal risk-mitigation item for US consumer apps, and a hard deadline for government or public-entity apps. Source. ABA on Title III digital accessibility.
These apply only to legitimate non-store card payments for real-world goods and services. digital goods and subscriptions must still route through Apple in-app purchase or Google Play Billing.
Verify. if the app takes EU or UK card payments for real goods, SCA and 3D Secure are implemented. if the app handles cards, no card number is stored, logged, or cached, entry goes to a tokenizing processor or a wallet, and the correct SAQ is identified. Sources. Stripe SCA guide, PCI SSC SAQ bulletin for v4.0.1.
| Gate | Verify | Platform |
|---|---|---|
| macOS notarization | Developer ID signed, hardened runtime, notarytool submitted, stapled | Apple (non-store macOS) |
| 4.2 / 4.3 | Not a thin wrapper, not a duplicate or clone, not an un-differentiated saturated-category app | Apple |
| Reader app entitlement | 3.1.3(a) conditions and link rules met, no IAP while used | Apple |
| France encryption | French ANSSI declaration uploaded if non-exempt crypto and distributed in France | Apple |
| Content rights | ASC third-party-content question answered, proof available | Apple |
| visionOS App Motion | Declared, Developer Capture screenshots | Apple |
| SDK 26 (all platforms) | Built with Xcode 26 and the platform-26 SDK by 28 April 2026 | Apple |
| SDK 27 (all platforms except macOS) | Built with the platform-27 SDK from April 2027, exact day not yet published | Apple |
| Developer verification | Verified before 30 Sep 2026 if distributing to Brazil, Indonesia, Singapore, Thailand | Android |
| Foreground service types | Manifest type + matching permission + Play Console declaration with demo video | Android |
| Play Integrity | No SafetyNet Attestation, verdict verified server-side | Android |
| Play Billing v8+ | Billing Library at least version 8 before 31 Aug 2026 | Android |
| Target API | targetSdkVersion at least 35 now, plan for 36 by Aug 2026 | Android |
| Disruptive ads | No launch or mid-task interstitial, closable by 15 seconds | Android |
| Health Connect | Declaration, core-function justification, org account, correct label | Android |
| UGC controls | Report, block, filter, published contact, 24-hour remove-and-eject (Apple 1.2) | Both |
| Child Safety Standards | Published CSAE URL, in-app report, response protocol, named contact (Social and Dating) | Google Play |
| CSAM reporting | NCMEC CyberTipline path and 1-year preservation for a US UGC app | Legal |
| Account and data deletion | In-app deletion plus a reachable web deletion URL, declared | Both |
| Sanctions | Entity and owners not SDN-listed, availability excludes embargoed territories, export-control review before a Syria release | Legal |
| Card payments | SCA and 3D Secure on EU or UK real-goods card flows, no PAN stored, correct PCI SAQ | Legal |
| Accessibility labels | Apple Accessibility Nutrition Labels populated and not over-claimed | Apple |
Apple facts cite developer.apple.com. Android and Google Play facts cite developer.android.com and the Play Console help. legal facts cite the statute, the regulator, or the standards body. Where a government or Apple page rendered as a client-side app that resisted an automated read, the fact was cross-checked across reputable sources and is flagged here.
All sources used for establishing regulatory requirements must adhere to the following priority guidelines:
Marked unverified, confirm against the primary source before relying on a figure. the 2026 Android target API 36 date (widely reported, consistent with the annual release pattern, but the official target-sdk page still showed the 2025 text at fetch time). the exact codesign, notarytool, and stapler command strings (corroborated across sources, not copied from a rendered Apple page). the exact visionOS, watchOS, and tvOS per-device screenshot pixel dimensions (pull live from the App Store Connect screenshot page). the exact date Apple’s Accessibility Nutrition Labels become mandatory (Apple says over time, no date published). the Google real-money-games India final rollout status. the EU CSA Regulation final form (in trilogue). the US BIS annual self-classification report specifics. and the PSD3 timing.
Treat this document as HARD on the existence and direction of each obligation, and advisory on any specific number, version, or date until re-verified against the cited source.