# Guideline 1.3 - Safety: Kids Category Third-Party SDK Violations

**Guideline:** 1.3 · **Store:** Apple App Store · **Severity:** high · **Fix difficulty:** medium · **Typical turnaround:** 1-3 days

Canonical URL: https://appstorereject.com/rejections/apple/1/guideline-13-safety-kids-category-third-party-sdk-violations

## Description

Apple is rejecting your app because it's listed in the Kids Category but includes third-party analytics or advertising SDKs that collect data from children. Kids Category apps may not send personally identifiable information or device information to third parties, and may not include third-party analytics or advertising. This is one of the most technically tricky rejections because the violation is often in an SDK you included for a legitimate purpose — Firebase Analytics, Facebook SDK, Amplitude, Mixpanel, or ad networks. These SDKs commonly collect device identifiers (IDFA, IDFV), device info, or usage data by default, which violates this guideline. Limited exceptions exist: third-party analytics may be used if the service doesn't collect or transmit IDFA or identifiable information about children. Contextual advertising may be permitted if the ad service has documented practices for Kids Category apps including human review of ad creatives. Once you opt into the Kids Category, you cannot relax these requirements in updates — you're locked in.

## Common variations

- Kids Category app includes third-party analytics that collects IDFA or PII
- App includes third-party advertising not compliant with Kids Category requirements
- Third-party SDK sends device information to external servers in a Kids Category app
- Kids app sends personally identifiable information to third parties

## Example rejection email

```
Guideline 1.3 - Safety - Kids Category

Your app is listed in the Kids Category but includes third-party analytics or advertising that is not appropriate for apps designed for children.

Specifically, your app includes [third-party analytics SDK / third-party advertising network] that may collect personally identifiable information or device information from children.

Next Steps:
Apps in the Kids Category may not include third-party analytics or third-party advertising that collects the IDFA or any identifiable information about children. Please remove or replace the third-party SDK(s) with services that comply with Kids Category requirements.
```

## Resolution steps

## Quick Assessment
- **Risk level:** High (also potential COPPA/GDPR-K legal implications)
- **Resolution path:** Fix & Resubmit
- **Typical turnaround:** 1-3 days

## The Fix

01. **Audit all third-party SDKs** — List every SDK in your app and check if it collects IDFA, IDFV, device info, location, or any PII. Common offenders: Firebase Analytics, Facebook SDK, Google AdMob, Amplitude, Mixpanel, Crashlytics.

02. **Remove or replace non-compliant SDKs** — Options:
   - Remove analytics entirely and use Apple's built-in App Analytics
   - Use a Kids Category-compliant analytics service that doesn't collect IDFA or PII
   - Configure SDKs to disable data collection (some support this, but Apple may still object to the SDK being present)

03. **Remove third-party ads** — Unless the ad network has documented Kids Category compliance with human-reviewed creatives, remove all third-party advertising.

04. **Check Privacy Nutrition Labels** — Update your App Store privacy labels to accurately reflect data collection after removing SDKs.

05. **Verify with a network proxy** — Use Charles Proxy or similar to verify your app sends no data to third-party analytics/ad servers.

## Prevention
- Audit SDKs before opting into the Kids Category
- Use Apple's built-in analytics for Kids Category apps
- Consider whether the Kids Category is worth the SDK restrictions for your app

## Before / after examples

**Before:** Kids Category app includes Firebase Analytics (collects IDFV and device info) and Google AdMob (targeted ads)
**After:** Firebase Analytics replaced with Apple's built-in App Analytics, AdMob removed entirely, network proxy test confirms zero third-party data collection
**Why it works:** Kids Category apps must not include third-party SDKs that collect any device or user data.

## Common questions

**How long does this typically take to fix?**

Typical turnaround is 1-3 days (difficulty: medium). After resubmission, most re-reviews complete within 24-48 hours.

---
*Machine-readable source: https://api.appstorereject.com/api/rejections/detail?slug=guideline-13-safety-kids-category-third-party-sdk-violations*