Apple tightens App Store rules on nonconsensual intimate imagery

Apple updated its App Store review rules on October 16, 2026, to explicitly address nonconsensual intimate imagery, including material produced with artificial intelligence tools. The company also strengthened its prohibition on apps that present one function during review and unlock different or harmful capabilities after approval.

The change arrives amid broader scrutiny of apps that can alter photographs to produce nude or sexual content without the depicted person’s consent. In an investigation published on Monday, October 19, the Tech Transparency Project said it identified 135 apps with such capabilities that were accessible to test accounts set up as belonging to 13-year-olds across Apple’s and Google’s stores.

What Apple changed

In Guideline 1.2, which covers user-generated content, Apple now expressly names nonconsensual intimate imagery. Developers must put safeguards in place to prevent and remove this material, including when it is generated with AI. According to the company, failing to implement adequate protections or to remedy a violation after notice can breach the developer code of conduct and result in removal from the App Store.

Guideline 2.5.19 is also more explicit about hidden, dormant or undocumented features. An app that conceals its purpose during review and later adds a prohibited tool may be removed from the store, while its operator may lose access to the Apple Developer Program. The language targets a bait-and-switch pattern in which a product appears to be a conventional editor during evaluation but changes behavior after it is approved.

Apple also revised its legal section to make clear that apps facilitating human trafficking, child exploitation or child sexual abuse material will be removed and blocked from alternative distribution. The company says that during the previous year it prevented more than 150,000 apps with safety issues from reaching users and terminated more than 193,000 developer accounts for fraud and abuse. Those figures are Apple’s own claims.

Policy and enforcement are not the same thing

The Tech Transparency Project findings help explain why the more specific wording matters, but the figures require context. The organization created four test accounts for a 13-year-old user, two in each ecosystem, with and without parental controls. It says Apple’s default teen account found 61 apps it classified as nudify-capable, while the supervised account found 24. On Google, the respective figures were 47 and 51.

Those numbers should not be added together because the results overlap; 135 is the total set identified by the study. The organization also used a broader definition than the one Apple described. It counted tools capable of placing people in bikinis or lingerie as well as producing nudity. Apple told the group that simply generating bikini or lingerie images does not qualify as nudification under its definition, although the separate prohibition on nonconsensual intimate imagery can still be relevant.

The report further says that age ratings supplied by developers allowed some apps to pass restrictions intended for minors. In the tests, Apple’s supervised account could access 24 apps rated as appropriate for a 13-year-old, and the equivalent Google account could access 51. The group also reported that apps removed from the stores remained functional on devices where they had already been installed.

The practical effect will depend on continued enforcement

The update gives Apple a more specific basis to act against two methods of evasion: inadequate moderation on services that host user content and harmful functions concealed during review. It does not, on its own, demonstrate that store screening, age ratings or advertising systems have already been fixed.

For photo and video editing developers, the consequence is concrete: tools with legitimate uses must anticipate abuse, document their functionality and respond to violations. For users and parents, the revision establishes a clearer platform obligation, but it does not replace effective controls or guarantee that already-installed software will be disabled. The decisive test will be whether the published rule is enforced consistently across new submissions and versions that change after approval.