# Guideline 5.1.1 - Privacy: Insufficient Purpose Strings

**Guideline:** 5.1.1 · **Store:** Apple App Store · **Fix difficulty:** easy · **Typical turnaround:** 1-2 hours

Canonical URL: https://appstorereject.com/rejections/apple/5/guideline-511-privacy-insufficient-purpose-strings

## Description

Apple is rejecting your app because one or more of the permission purpose strings (NSUsageDescription entries in Info.plist) don't adequately explain why the app needs access to protected resources like the camera, microphone, location, contacts, or photos. Purpose strings must clearly and completely describe (1) how the app uses the data and (2) a specific example of how the data will be used. Generic strings like "App needs camera access" or "App would like to access your contacts" are explicitly called out by Apple as insufficient. This is a different rejection than 5.1.1 privacy policy issues. This is specifically about the system permission dialogs that appear when your app requests access to device capabilities.

## Common variations

- Purpose strings do not sufficiently explain use of protected resources
- Camera purpose string does not provide specific example
- Location purpose string is too vague
- Microphone/contacts/photos purpose string is generic

## Example rejection email

```
One or more purpose strings in the app do not sufficiently explain the use of protected resources. Purpose strings must clearly and completely describe the app's use of data and, in most cases, provide an example of how the data will be used.

Update the camera purpose string to explain how the app will use the requested information and provide a specific example of how the data will be used. See the attached screenshot.

Purpose strings must clearly describe how an app uses the ability, data, or resource. The following are hypothetical examples of unclear purpose strings that would not pass review:

- "App would like to access your Contacts"
- "App needs microphone access"
```

## Resolution steps

## Quick Assessment

Open your Info.plist and read every `NSUsageDescription` string. Does each one explain WHY your app needs the permission AND give a concrete example? If it just says what it accesses, it's insufficient.

## The Fix

1. **Rewrite each purpose string** — Follow this formula: "[App name] uses [resource] to [specific purpose]. For example, [concrete example of use]."

2. **Be specific, not generic** — Instead of "App needs camera access", write "AppName uses your camera to take photos of receipts for expense tracking. For example, you can photograph a restaurant receipt to automatically log the expense."

3. **Cover all protected resources** — Check every `NS*UsageDescription` key:
   - `NSCameraUsageDescription`
   - `NSMicrophoneUsageDescription`
   - `NSLocationWhenInUseUsageDescription`
   - `NSPhotoLibraryUsageDescription`
   - `NSContactsUsageDescription`
   - Any others your app uses

4. **Match actual usage** — The purpose string must match what your app actually does with the data. Don't claim you use the camera for "profile photos" if you also use it for document scanning.

5. **Localize purpose strings** — If your app supports multiple languages, translate purpose strings for each locale.

## Prevention

- Write purpose strings when you add the permission request, not as an afterthought
- Include both the purpose AND a specific example in every string
- Review Apple's examples of helpful, informative purpose strings in the HIG

## Before / after examples

**Before:** NSCameraUsageDescription: 'App needs camera access'
**After:** NSCameraUsageDescription: 'MyApp uses your camera to scan documents and take photos for your projects. For example, you can photograph a whiteboard to save meeting notes.'
**Why it works:** Purpose strings must explain the specific use case and provide a concrete example, not just state the resource being accessed

## Common questions

**How long does this typically take to fix?**

Typical turnaround is 1-2 hours (difficulty: easy). After resubmission, most re-reviews complete within 24-48 hours.

---
*Machine-readable source: https://api.appstorereject.com/api/rejections/detail?slug=guideline-511-privacy-insufficient-purpose-strings*