# Guideline 4.7.1 - Design: Mini App or Game Not Following IAP or Privacy Rules

**Guideline:** 4.7.1 · **Store:** Apple App Store · **Severity:** high · **Fix difficulty:** hard · **Typical turnaround:** 1-3 days

Canonical URL: https://appstorereject.com/rejections/apple/4/guideline-471-design-mini-app-or-game-not-following-iap-or-privacy-rules

## Description

Apple is rejecting your app because it hosts mini apps, mini games, or other embedded software experiences that do not comply with Apple's in-app purchase and privacy requirements. If your app is a platform that hosts third-party games, interactive experiences, or app-like content (think HTML5 game portals, chatbot app stores, or plugin marketplaces), each hosted experience must follow the same rules as a standalone App Store app. This means: any digital purchases within mini apps must use Apple's In-App Purchase system (not the mini app developer's own payment system), each mini app must have a privacy policy and adhere to App Store data collection guidelines, and mini apps cannot request permissions beyond what the host app declares. This rejection became more prominent with the rise of 'super apps' and platforms that try to create their own app ecosystems within a single App Store listing. Apple's position is that hosted software cannot be used to circumvent App Store rules — even if the host app itself is compliant, every experience within it must also comply. The fastest compliant path depends on scope. For a small number of embedded games, implementing IAP and privacy compliance for each is feasible. For a large platform, you may need to fundamentally rethink your architecture to route all purchases through your app's IAP implementation.

## Common variations

- Hosted mini apps include their own payment mechanisms
- Mini games do not use Apple's In-App Purchase system
- Hosted content lacks adequate privacy disclosures
- Mini apps collect user data beyond host app's declared practices
- Platform hosts software that doesn't comply with App Store guidelines

## Example rejection email

```
Guideline 4.7.1 - Design - HTML5 Games, Bots, etc.

Your app provides a platform for hosting mini apps or games that do not comply with App Store requirements. Specifically:

- One or more hosted experiences include their own payment mechanisms that do not use Apple's In-App Purchase system
- Hosted content does not include adequate privacy disclosures
- Mini apps collect user data without following the host app's declared data practices

All software experiences hosted within your app must comply with the App Store Review Guidelines, including requirements for in-app purchases and user privacy.

Next Steps:
Please revise your app to ensure all hosted mini apps and games:
- Use Apple's In-App Purchase system for any digital purchases
- Include appropriate privacy disclosures
- Do not collect data beyond what the host app declares in its privacy nutrition label
```

## Resolution steps

## Quick Assessment
- **Risk level:** High — IAP circumvention is a serious violation
- **Resolution path:** Implement IAP and privacy compliance for all hosted experiences
- **Typical turnaround:** 1-3 days

## The Fix

01. **Audit all hosted experiences** — Catalog every mini app, game, or interactive experience your platform hosts. For each, document: does it have purchases? Does it collect data? Does it request permissions?

02. **Route purchases through your IAP** — Implement a unified IAP layer in your host app. When a mini app needs to charge for digital content, it must call your app's StoreKit implementation, not its own payment form.

03. **Create a virtual currency or token system** — If mini apps have many small purchases, consider a token/coin system purchased through IAP. Mini apps spend tokens rather than charging directly.

04. **Implement privacy compliance per mini app** — Each mini app must have a privacy policy link. The host app's nutrition label must cover the union of all data practices across all hosted experiences.

05. **Restrict data collection** — Implement a sandboxing layer that prevents mini apps from accessing data beyond what your host app declares. Block unauthorized API access from hosted code.

06. **Update your App Privacy nutrition label** — Your App Store Connect privacy label must accurately reflect ALL data collected by ALL hosted experiences, not just the host app.

## Prevention
- Build IAP integration into your mini app SDK/platform from day one
- Create a submission/review process for mini apps that checks compliance before publishing
- Maintain a comprehensive privacy label that accounts for all hosted content
- Document your compliance architecture in Review Notes

## Appeal guidance

Appeal is generally not effective for IAP violations. If the privacy concern is based on a misunderstanding (e.g., the reviewer thought a mini app collects data when it doesn't), explain the data flow in detail. For IAP violations, implement compliance and resubmit.

## Before / after examples

**Before:** HTML5 game portal hosts 30 mini games, several of which have their own Stripe payment forms for power-ups and none have privacy policies
**After:** All in-game purchases converted to a coin system purchased through the host app's IAP, each game displays a privacy policy link, and a sandboxing layer prevents games from accessing device APIs or collecting data beyond what the host app declares
**Why it works:** Every experience hosted within your app must comply with App Store rules as if it were a standalone app. The host app is responsible for enforcing compliance.

## Common questions

**Can you appeal a 4.7.1 rejection?**

Appeal is generally not effective for IAP violations. If the privacy concern is based on a misunderstanding (e.g., the reviewer thought a mini app collects data when it doesn't), explain the data flow in detail. For IAP violations, implement compliance and resubmit.

**How long does this typically take to fix?**

Typical turnaround is 1-3 days (difficulty: hard). After resubmission, most re-reviews complete within 24-48 hours.

---
*Machine-readable source: https://api.appstorereject.com/api/rejections/detail?slug=guideline-471-design-mini-app-or-game-not-following-iap-or-privacy-rules*