App Store & Google Play Store Compliance & Fixes
Browse emergency technical fixes and request a 24h diagnostic to unblock your iOS & Android app submissions.
App must target Android 16 (API level 36)
Google Play requires that all active apps target Android 16 (API 36). Without this upgrade, publishing new versions and app updates is completely blocked on the Play Console.
Update the `variables.gradle` or `build.gradle` file by setting `targetSdkVersion = 36` and `compileSdkVersion = 36`, then adapt permissions and compile with Android Gradle Plugin 8.5+.
Photo/Video Permission: Replace READ_MEDIA_IMAGES with Android Photo Picker
According to the Google Play Privacy Policy, apps targeting Android 13+ (API 33+) can no longer request the broad `READ_MEDIA_IMAGES` and `READ_MEDIA_VIDEO` permissions if the system Android Photo Picker is sufficient for the use case.
Remove the `READ_MEDIA_IMAGES` / `READ_MEDIA_VIDEO` permissions from your `AndroidManifest.xml` and switch to the Capacitor Camera v6+ plugin or the native Android `PickVisualMedia` picker.
Privacy Manifests Required: Missing PrivacyInfo.xcprivacy File
Apple rejects App Store submissions for third-party apps and SDKs that do not include a `PrivacyInfo.xcprivacy` file justifying access to system APIs (File Timestamp, System Boot Time, Disk Space, User Defaults).
Add a `PrivacyInfo.xcprivacy` file to the root of your Xcode target and list the reasons for using APIs required by your Capacitor/CocoaPods plugins.
Apple Guideline 4.2 Rejection: Minimum Functionality & WebView Wrapping
The App Store rejects applications that look like a simple website wrapped in a WebView without providing any real native added value.
Integrate deep native features (FaceID Biometrics, Firebase Push Notifications, Haptics, Offline support, smooth navigation) to certify the native experience.
Apple Guideline 4.8 Rejection: Mandatory Sign in with Apple (SIWA) with Google Login
The Apple App Store automatically rejects any iOS app offering third-party social logins (Google Sign-In, Facebook Login, etc.) if Sign in with Apple is not offered with equivalent prominence.
Install the native @capacitor-community/apple-sign-in plugin, capture the user's fullName and email on the initial session, and cryptographically verify the identityToken server-side.
GDPR Compliance for Mobile Apps & Capacitor
Mobile apps collecting user data without explicit consent or local encryption expose themselves to regulatory fines and store removal.
Implement consent flow on first launch and encrypt local native storage using SecureStorage Plugin.
Cookie Consent & Apple ATT (App Tracking Transparency)
Any iOS app conducting cross-app tracking must present the native AppTrackingTransparency prompt or face immediate rejection by Apple.
Integrate `@capacitor-community/app-tracking-transparency` and set `NSUserTrackingUsageDescription` in `Info.plist`.
Mobile Accessibility Compliance (WCAG / VoiceOver / TalkBack)
European accessibility directives mandate accessible mobile applications for visually impaired or disabled users.
Add native ARIA attributes (`aria-label`, `role`) and validate VoiceOver / TalkBack screen reader navigation.
Global App Store & Google Play Compliance Audit
Growing requirements from Apple and Google make submission complex with high risks of permanent rejection.
Perform a pre-submission audit covering privacy policies, API security, and UX/UI guidelines.
Apple Guideline 2.3.1 Rejection: Fake Reviews & Misleading Social Proof on iOS Paywalls
The Apple App Store strictly forbids displaying fabricated ratings, inflated counters (e.g., '1M+ positive reviews' or fake 5-star badges), and fake testimonials on iOS paywalls or metadata. While some apps pass initial App Review and scale to $10k+ MRR, these deceptive tactics are systematically purged during retrospective Review Sweeps, resulting in permanent developer account termination under Guideline 5.6.3.
Immediately remove fake reviews, inflated numbers, and counterfeit store badges from your paywall. Replace them with verifiable usage metrics, authentic customer reviews fetched via API, and transparent subscription terms compliant with FTC and EU Omnibus directives.
24h Emergency Diagnostic & Fix
Direct technical assistance by Julien Kermarec, certified Ionic Developer Expert.