Apple has updated its App Review Guidelines with a set of changes aimed squarely at AI nudification apps and the developers who try to slip harmful features past the App Store’s review process. The revisions, announced on October 16, tighten rules around user-generated content, explicitly ban hidden or undocumented app features, and sharpen the language used to remove apps tied to exploitation or trafficking.
Why Apple is acting now
The update follows more than a year of reports exposing gaps in App Store enforcement. In January, the Tech Transparency Project identified dozens of AI-powered “nudify” apps available on the App Store, tools that use AI to generate fake nude images of real people without consent. A follow-up investigation in April found that Apple’s own search suggestions and ads were sometimes pointing users toward these same apps. By July, San Francisco officials had ordered Apple to pull eight apps capable of producing nonconsensual intimate imagery.
That same month, a 9to5Mac investigation uncovered a different kind of abuse: apps disguised as simple games or utilities that secretly functioned as gambling platforms once opened from certain locations, including some reachable by children. And the controversy around Elon Musk’s Grok chatbot, which was used to generate nonconsensual sexualized images of women and minors, added further pressure, with Apple later confirming it had privately warned xAI that Grok could be removed from the App Store if the issue wasn’t addressed.
What the new rules actually say
Apple’s changes touch three parts of its guidelines. Under Section 1.2, covering user-generated content, Apple now states that developers who “fail to implement appropriate safeguards or fail to remediate identified violations after notice” can be considered in violation of its Developer Code of Conduct. That gives Apple clearer grounds to act against apps that allow users to generate or share harmful content, including nonconsensual intimate imagery, rather than relying solely on complaints or press investigations.
The more notable change is a newly created Section 2.5.19, which directly addresses apps that misrepresent themselves during review. It reads: “Don’t include any hidden, dormant, or undocumented features in your app; your app’s functionality should be clear to end users and App Review. Attempting to hide undocumented features in your app binary, such as through code obfuscation or other methods, is grounds for removal of your app from the App Store and termination of your developer account.” This targets the exact “bait-and-switch” pattern seen in both the nudify-app reports and the hidden gambling apps, where software behaves one way during Apple’s review and reveals different, often harmful, functionality afterward.
Closing the bait-and-switch loophole
A rule against hidden functionality already existed in Section 2.3.1, but Apple has now made it far more specific, calling out code obfuscation by name and spelling out that violations can lead to both app removal and the termination of a developer’s account entirely. That’s a meaningful escalation: instead of just losing one app, a developer caught hiding features risks losing the ability to publish anything on the App Store. For an industry where some operators spin up multiple shell-like apps to evade detection, a developer-account-level penalty is a much bigger deterrent than a single app takedown.
Apple also strengthened Section 5, the legal section of its guidelines, to state explicitly that apps facilitating human trafficking or the exploitation of children “will be removed from the App Store and blocked from alternative distribution.” That last phrase matters in regions where Apple now allows alternative app marketplaces; it signals that these restrictions aren’t meant to be limited to Apple’s own storefront.
What this means for developers and users
For legitimate developers, the practical impact should be minimal, since the core expectation, that an app’s functionality must match what reviewers see, was already part of the rules. What’s changed is the specificity and the stakes: calling out code obfuscation by name removes any ambiguity about whether disguising features counts as a violation, and tying it to developer account termination raises the cost of getting caught.
For users, especially parents monitoring what their kids can download, the update is a signal that Apple is responding to specific, documented failures rather than issuing a general policy refresh. Whether enforcement actually improves will depend on how aggressively Apple applies these rules going forward, since the AI nudification and hidden-gambling-app problems were identified by outside researchers and journalists rather than caught by Apple’s own review process in the first place.
The bottom line
Apple’s updated guidelines don’t introduce new technology or user-facing features, but they do close specific gaps that bad actors have exploited over the past year, from AI nudification tools to gambling apps masquerading as games. The real test will be whether Apple’s review process catches these bait-and-switch tactics before they reach users, rather than after investigations and regulatory pressure force a response.
