Guideline 5.4
Guideline 5.4 - Legal: VPN App Without Data Usage Declaration
Our Take
Apple is rejecting your VPN app because it does not clearly declare what user data the VPN collects, how it is used, and how long it is retained. Guideline 5.4 requires VPN apps to include a clear, specific data usage declaration both within the app and in the privacy policy, because VPN services by nature have access to sensitive user traffic. This rejection differs from the individual-developer or NEVPNManager rejections under the same guideline — here, the organization and technical requirements may be met, but the data transparency is insufficient. Apple wants users to make informed decisions about which VPN to trust with their traffic. The declaration must go beyond a generic 'we collect some data' privacy policy. Apple expects VPN apps to specifically address: whether browsing activity or DNS queries are logged, whether connection timestamps and IP addresses are recorded, whether bandwidth usage data is stored, how long any collected data is retained, whether any data is shared with third parties or law enforcement, and what happens to data when the account is deleted.
Resolution Guide
**Create a VPN-specific data section** — In your privacy policy, add a dedicated section titled 'VPN Data Practices' or similar that addresses each required disclosure point.
**Declare logging practices** — Explicitly state whether your VPN logs: browsing activity, DNS queries, connection timestamps, source IP addresses, destination IP addresses, or bandwidth usage. If you have a no-logs policy, state it clearly and specifically.
**State data retention periods** — For any data collected, state how long it is retained (e.g., '30 days,' 'until account deletion,' 'never stored').
**Address third-party sharing** — Declare whether any VPN data is shared with third parties, including in response to law enforcement, legal processes, or government requests.
**Add in-app disclosure** — Beyond the privacy policy, add a clear data practices summary within the app itself — in the settings, about screen, or during onboarding.
**Update App Privacy labels** — Ensure your App Privacy nutrition labels in App Store Connect accurately reflect the VPN's data practices.
Prevention
Example Rejection Email
Consider Appealing
Appeal if your privacy policy and in-app disclosures already contain the required information but the reviewer missed it. Provide specific excerpts showing where each required declaration appears. Otherwise, update and resubmit.
Before & After
VPN app's privacy policy contains a single generic paragraph: 'We may collect certain data to provide our services. We take privacy seriously.'
Privacy policy includes a 'VPN Data Practices' section stating: 'We do not log browsing activity, DNS queries, or destination IP addresses. We retain connection timestamps and bandwidth usage for 24 hours for abuse prevention. No VPN data is shared with third parties. Upon account deletion, all data is purged within 7 days.'
What changed: VPN privacy policies must be specific about exactly what traffic data is and isn't logged. Generic statements are insufficient.
Community Solutions · 0
Sign in to share your solution.
More Guideline 5 (Legal) rejections
- Guideline 5 - Legal: Remove Watermark Feature
- Guideline 5.1.1 - Data Collection and Storage: Incomplete Privacy Manifest
- Guideline 5.1.1 - Data Collection and Storage: Missing Purpose Strings
- Guideline 5.1.1 - Data Collection and Storage: Privacy Manifest Missing
- Guideline 5.1.1 - Data Collection and Storage: Privacy Nutrition Label Mismatch
- Guideline 5.1.1 - Data Collection and Storage: Privacy Policy