If people can sign up in your app, they have to be able to delete the account in your app.
The rule is App Store Review Guideline 5.1.1(v), under Account Sign-In, and it is one sentence long: if your app supports account creation, you must also offer account deletion within the app. The guidelines page carries its own Last Updated line of 16 October 2026, read on 21 October 2026. Google Play has a matching rule in its User Data policy, the Account Deletion Requirement, and it asks for one thing Apple does not: a web page where the same request can be made by somebody who has already uninstalled the app. Most people meet this rule late, halfway through publishing to the App Store.
What follows is where each rule is written, what the flow has to do once someone taps the button, where the two stores stop agreeing, and who is documented as exempt. Every figure below carries the date it was read.
See which rule applies to youThe short version
One button in the app, and for Google one page on your website.
Apple wants the option to start deletion inside the app, easy to find, usually in account settings. If the deletion itself finishes on your website, Apple accepts that, provided the app links directly to the page where it can be completed rather than to your home page. Google wants the same in-app path and, separately, a web resource anyone can reach without the app, with its URL typed into the Data safety form in Play Console.
Both stores reject the same shortcut. Deactivating, disabling or freezing an account does not count. The account record goes, and so does the data attached to it, apart from whatever the law makes you keep, which you then have to tell people about. Neither store demands that any of this happen instantly.
Which guideline requires account deletion inside the app?
Guideline 5.1.1(v), the paragraph headed Account Sign-In inside section 5.1.1, Data Collection and Storage. The same paragraph tells you to let people use the app without a login if it has no real account-based features, and then says that an app supporting account creation must also offer account deletion within the app. Apple publishes a separate App Review Help page devoted to that one clause under the title 5.1.1(v), Offering account deletion in your app, and that page is where the detail lives.
The scope is wider than a sign-up screen. Apple answers four edge cases on that page and says yes to all of them. An app that creates an account for the user automatically, sometimes called a guest account, still needs a way to delete it. An app that hands sign-up off to the default web browser still needs in-app deletion, and Apple adds that the browser handoff is a poor experience and not appropriate under Guideline 4. An app that already offers deletion to comply with the GDPR or the CCPA has not finished, because everyone has to be able to delete their account regardless of where they are. You may reuse the flow you built for one region, as long as it meets 5.1.1(v) and you open it to everybody.
Confirmation steps are fine, which surprises people who expect any friction to fail review. Apple says it is appropriate to confirm that the person genuinely intends to delete the account, and that you may verify their identity, for instance with a code sent to an email address or phone number already on the account. The limit is stated in the same answer: apps that make it unnecessarily difficult to delete an account will not pass review. A reauthentication prompt is a safeguard. Four screens of retention offers is an obstacle.
This is one of two account-shaped things a first submission tends to trip over. The other is consent for anything you send afterwards, which the push notification permission prompt page covers, and which lands in the same review. Build both before the first upload and neither one costs you a rejection.
Apple, App Review Help, 5.1.1(v) Offering account deletion in your app, read 21 October 2026
Check yours
Which deletion route your app owes
Tick what your app does. Each store answers the same question differently, so both answers are shown.
Nothing ticked. An app with no sign-up and no accounts of any kind owes neither store a deletion path.
What exactly does the deletion flow have to do?
Apple sets out four things on its 5.1.1(v) page and they are all testable. Make the option easy to find, typically in account settings. Offer to delete the entire account record along with associated personal data, because offering only a temporary deactivate or disable is insufficient. If the process has to be finished on your website, link directly to the page where it is completed, and on tvOS present a static URL or a QR code that goes to that page. Keep people informed, which means telling them if it will take time, explaining how billing and cancellations are handled when the app sells in-app purchases, and saying what you are legally required to retain.
Content counts as data. Apple answers the user-generated content question on the same page and says people expect everything attached to their account to go, including material shared with other people such as photos, videos, text posts and reviews. If the law makes you keep some of it, say which part. The practical consequence is a server-side job rather than a screen: your delete endpoint has to walk the rows that reference the account, not only the account row.
Sign in with Apple needs one extra call. Apple's guidance says to use the Sign in with Apple REST API to revoke user tokens, and to use server-to-server notification endpoints to process changes for those accounts. Developers based in the Republic of Korea are told they must provide a server-to-server notification endpoint when registering a new Services ID. Deleting your own user row leaves the Apple-side grant in place, so the revoke call is the part that actually finishes the job.
Subscriptions are the awkward case, and Apple answers it rather than leaving it to you. Notify the person that billing continues through Apple and ask them to cancel the subscription before they continue. Apple points at showManageSubscriptions, available from iOS 15 and iPadOS 15 onward, and at a direct link to the account subscriptions page on apps.apple.com. You may also offer to schedule the deletion for the date the subscription expires, as long as deleting immediately is still on offer. All of the above read on 21 October 2026.
Apple, App Review Help, 5.1.1(v) account deletion guidance and FAQs, read 21 October 2026
Does Google Play have a matching requirement, and does it want a web route?
It does, and yes it wants a web route. Google Play Console Help calls it the Account Deletion Requirement and puts it inside the User Data policy. If your app lets users create an account from within the app, you must give them an in-app path to delete that account and its data, and you must give them a web link resource where they can request the same deletion. The URL goes into a designated field in the Data safety form, on the App content page in Play Console, and the answers surface in the Data deletion area of your store listing.
Google explains why it asks for both, and the reason is the one developers forget. Some people have already uninstalled the app, or cannot reach the in-app flow, so the web resource has to let them request deletion without sending them back into the app to re-download it. Google then sets conditions on the page itself. It has to load without error. The deletion pathway has to be prominent and easy to find on it. It has to reference the app or developer name as that name appears on your Google Play listing. A customer service email or a submission form is an acceptable mechanism. If you lean on an existing privacy or retention policy, the deletion part has to be made prominent, and Google suggests an anchor link.
Three details catch people. Offering some features without an account changes nothing: Google says if your app offers account creation anywhere in the experience, you still owe deletion. An app that pushes sign-up to a flow outside the app is still treated as supporting account creation in the app. And the questions themselves sit inside the Data safety form rather than in a page of their own, so the google play data safety form walkthrough is where they turn up in order.
One thing to know about the source, because it will confuse you when you read it. The help page still carries its original roll-out timeline in the future tense, as of 21 October 2026. It names 7 December 2023 as the deadline to complete the Data deletion questions, an extension available on request to 31 May 2024, and says non-compliant apps may face further enforcement after that date. Both dates have long passed, so there is no grace period left to apply for. The requirement is simply live. Store rules carry dates the way platform requirements do, and the ios sdk version deadline page tracks the other one worth a calendar entry.
Are there documented exceptions, and who gets them?
There are, and they are narrow. Google names two outright exemptions: permanently private apps and enterprise device management apps. It also says that accounts created and operated offline are not app accounts and fall outside the policy, which is the carve-out for a local profile that never reaches a server. And it defines an app account tightly enough to test against: a unique user identity you provide as a user-facing feature, serving the user across applications or devices, with some way to authenticate, such as a password, a one-time code, two-factor authentication, biometrics or single sign-on.
Regulated fields get a softer flow rather than an exemption. Apple says apps in highly regulated industries, as described in Guideline 5.1.1(ix), may use additional customer service flows to confirm and facilitate the deletion. That guideline names banking and financial services, healthcare, gambling, legal cannabis use, air travel and crypto exchanges. Google says much the same, that additional flows to carry a deletion request through to completion are permissible in a highly regulated industry, and its examples are utilities, healthcare and financial services. Everyone outside those fields is told plainly by Apple not to make people phone, email or use a chat support flow.
Non-mobile surfaces are the third relaxation, and only Google frames it as one. Google says apps on web, Android TV, Wear OS and similar surfaces do not have to offer in-app initiation, but still need a readily discoverable way to start deletion outside the app, with that URL entered in Play Console. Apple handles the same problem inside the requirement rather than beside it: on tvOS you may present a static URL or a QR code that links directly to the deletion page.
Two things are worth saying about what is not on these pages. Apple publishes no exemption for a private, internal or enterprise app on its 5.1.1(v) guidance page, which is the page where such an exemption would sit, so do not borrow Google's. And both stores allow retention rather than exempting it: Apple says to tell people what will and will not be kept, and Google says data held for security, fraud prevention or regulatory compliance has to be disclosed, for example in your privacy policy. Retaining quietly is the part that fails.
Google Play Console Help, account deletion requirements, exemptions and FAQs, read 21 October 2026
The same rule, written twice
| What is asked | App Store, 5.1.1(v) | Google Play, User Data policy | Same answer on both |
|---|---|---|---|
| Where the rule is written | App Review Guideline 5.1.1(v), Account Sign-In | User Data policy, the Account Deletion Requirement | No |
| An option to start deletion inside the app | Yes | Yes | Yes |
| A web route that works without the app | Only if deletion finishes on your site, and then the app links to that exact page | Required either way, and the URL is typed into the Data safety form | No |
| Deactivating instead of deleting | Offering only a temporary disable is insufficient | Freezing or disabling does not qualify as deletion | Yes |
| The data has to go as well | The account record plus associated personal data you are not legally required to keep | All user data associated with that app account | Yes |
| Slow or manual deletion | Allowed. Say how long it will take and confirm when it is done | Allowed within a reasonably quick period, and tell people what to expect | Yes |
| Non-mobile surfaces | On tvOS a static URL or QR code to the deletion page is accepted | Web, Android TV and Wear OS need no in-app path, only the web resource | No |
Where this lands if a builder generated your app
The rule attaches to the app, not to who typed the code. If the generated app has sign-up, it owes a deletion path, and on iOS you are the one who presses submit. Guideline 4.2.6 is why: an app created from a commercialized template or app generation service is rejected unless the provider of the app's content submits it directly. So the deletion flow, the privacy policy and the submission are all yours.
Newly is an AI app builder. You describe an app in plain English and it writes a real React Native and Expo project you own, with two-way GitHub sync. It uploads iOS builds to TestFlight, publishes to Google Play internal testing and builds a standalone Android APK. The price is $25 a month and there is no free tier. The useful part here is the starting point: a new app has no accounts and no server, so it owes neither store a deletion path until you ask for sign-in.
The day you do ask, the work arrives in two halves. The screen is the easy half, and an agent will put a delete option in account settings with a confirmation step if you say so. The half that needs a decision is what happens on the server: which rows go, which content goes with them, whether a Sign in with Apple token gets revoked, and what you keep for fraud or tax reasons and then disclose. Ask for it when you add sign-in, not in the week you submit.
Questions people ask about the account deletion requirement
It is App Store Review Guideline 5.1.1(v), under Account Sign-In. The sentence is short: if your app supports account creation, you must also offer account deletion within the app. Apple's guideline reference page for 5.1.1(v) adds that deleting an account removes the account from the developer's records along with any associated data the developer is not legally required to keep. Google Play has its own version of the rule inside the User Data policy, called the Account Deletion Requirement, and it asks for one thing more than Apple does: a web link where the same request can be made. Both pages read 21 October 2026.
Add the delete button the day you add the login
It is an afternoon while you are building and a rejection if you leave it. Describe the account screens you want, including the way out, and the deletion page on your website that Google will ask for.
Start building