Apple on October 16, 2026 published revisions to its App Review Guidelines that name nonconsensual intimate imagery, including material generated with AI tools, as content apps must prevent and remove, and that restate in a new guideline numbered 2.5.19 the prohibition on apps that behave one way during review and another after approval. A third change says apps facilitating human trafficking or the exploitation of children will be removed from the App Store and blocked from alternative distribution.

In Short

Apple changed the rulebook every iPhone app must follow so that apps letting people make or share fake sexual pictures of real people, often made with AI, have to stop and delete that material. It also made clearer that an app cannot show reviewers one thing and then switch on hidden features, such as "nudification", once it is live. Developers who break these rules can lose their app and their developer account, although the published rules and Apple's own summary of them do not use exactly the same words.

What Apple published on October 16

The changes arrived in two documents. The first is a short post in Apple's developer news feed, headed "Strengthening App Review Guidelines against nonconsensual intimate imagery and bait-and-switch apps" and dated October 16, 2026. The second is the full App Review Guidelines page, which carries a "Last Updated: October 16, 2026" stamp at the bottom. The dates match.

The news post lists three changes: guideline 1.2 on user-generated content, a guideline numbered 2.5.19, and the introduction to Section 5, the legal section. According to Apple, the purpose is to "strengthen and extend the existing App Store protections, continuing to build on our long-held standards for privacy, quality, and safety."

Apple frames none of this as a new prohibition. "As outlined in our App Review Guidelines, pornographic material has long been prohibited on the App Store," the post states, adding that this "includes apps that generate nudity or sexually explicit imagery, such as 'nudification' apps that create sexually explicit images of real individuals without their consent." Hidden or undocumented features, the post continues, were already banned, "including apps that misrepresent their purpose during review and only reveal harmful capabilities - such as 'nudification' - after approval, a tactic commonly known as bait-and-switch."

The phrase "long been prohibited" carries weight. If the rules already covered nudification apps, the update amounts to a restatement, with sharper language and, in places, stated penalties. Whether the wording on the guidelines page matches the summary in the news post is a separate question, and the answer is: not exactly.

Guideline 1.2: nonconsensual intimate imagery

What the news post says

According to Apple's news post, content moderation requirements under 1.2 "now explicitly cover nonconsensual intimate imagery - including imagery generated using AI tools - as content that apps must proactively prevent and remove from their platforms." The post adds that developers "who fail to implement adequate safeguards - or don't remedy violations after notice - risk violating the Developer Code of Conduct and being removed from the App Store."

What the guidelines page says

The guideline itself, as published on the guidelines page, opens differently. "Apps that enable users to create, generate, upload, share, or otherwise contribute content present particular challenges, including intellectual property infringement, nonconsensual intimate imagery, and anonymous bullying," it reads. "This includes social media, user-generated content platforms, and AI content creation apps."

Four safeguards follow, unchanged in substance from the familiar list: a method for filtering objectionable material before it is posted, a mechanism to report offensive content with "timely responses to concerns", the ability to block abusive users, and published contact information.

The enforcement language sits in a closing paragraph. "It is your responsibility to remove content that violates this guideline, your terms of service, or your community standards," the page states. "Developers who fail to implement appropriate safeguards or fail to remediate identified violations after notice may be considered in violation of the Developer Code of Conduct." The page then sets out a sequence: Apple will ask the developer to remove the content and "provide a plan to improve your compliance with this guideline." Depending on the response, the app "may be removed from the App Store until you can demonstrate improvements." The paragraph closes with: "Egregious or repeated behavior is grounds for immediate removal of your app from the App Store, and from the Apple Developer Program."

Where the two documents differ

Three gaps stand out. The word "proactively" appears in the news post but nowhere in guideline 1.2 as published. The phrase "imagery generated using AI tools" also appears only in the news post. The guidelines page instead names "AI content creation apps" as a category of app subject to 1.2, which describes the type of app rather than the type of image. Whether a nonconsensual image produced by a traditional photo editor falls under the same language is not addressed in either text.

The penalties differ in tone, too. The news post says non-compliant developers "risk" Code of Conduct violations and App Store removal. The page lays out a stepped process, beginning with a request and a remediation plan, and keeps immediate removal and expulsion from the Developer Program for "egregious or repeated" cases.

The news post does not say which phrases in 1.2 are new. The guidelines page shows no change markers. Based on the two documents alone, the explicit naming of nonconsensual intimate imagery is the change Apple's post confirms; the remediation paragraph and the reference to AI content creation apps are visible on the page, but the news post does not identify them as new or old. The list of excluded app types in the same guideline, which names "Chatroulette-style experiences, random or anonymous chat" and "objectification of real people (such as 'hot-or-not' voting)", predates this update. According to 9to5Mac, Apple added "random or anonymous chat" to that list in February 2026.

The rule touches a sub-guideline that already had a recent history. Apple revised guideline 1.2.1(a) on November 13, 2025, requiring creator apps to restrict content above an app's age rating using "verified or declared age". That clause is unchanged on the October 16 page.

Guideline 2.5.19: bait-and-switch

Apple's description

According to the news post, 2.5.19 "clarifies our longstanding prohibition on apps misrepresenting what they do during the App Review process and then changing after approval - for example, adding features or functionality that weren't included in the version of the app that was submitted to App Review." Apps "found engaging in this conduct are subject to removal from the App Store and removal from the Apple Developer Program," Apple states.

The published text

Guideline 2.5.19 on the page reads in full: "Don't include any hidden, dormant, or undocumented features in your app; your app's functionality should be clear to end users and App Review. Attempting to hide undocumented features in your app binary, such as through code obfuscation or other methods, is grounds for removal of your app from the App Store and termination of your developer account."

It is the last item in Section 2.5, Software Requirements, placed after 2.5.18, which governs display advertising.

Where the two documents differ

The published 2.5.19 does not contain the words "approval", "after" or "bait-and-switch". It prohibits features that are hidden, dormant or undocumented, and names code obfuscation as one method of hiding them. The news post's example, features added after approval that were absent from the submitted version, is a reasonable reading of "dormant", since a dormant feature is one that exists in the binary but switches on later. Yet the page does not spell that out. A developer who ships a clean binary and then changes behavior through a server-side switch is described in the news post's language more clearly than in the guideline's.

The sanctions are phrased differently as well. The news post says "removal from the Apple Developer Program"; the page says "termination of your developer account." The two likely amount to the same outcome, but the documents do not use the same words.

The sentence prohibiting hidden, dormant or undocumented features is itself not new. In editions of the guidelines published before this update, it opened guideline 2.3.1(a), under Accurate Metadata. On the October 16 page, 2.3.1(a) now begins with the requirement that "all new features, functionality, and product changes must be described with specificity in the Notes for Review section of App Store Connect." The hidden-features sentence has moved to 2.5.19, where it gains an explicit penalty. The news post does not mention the move.

One more difference matters. Guideline 2.3.1(a) on the page says misleading marketing "is grounds for removal of your app from the App Store or a block from installing via alternative distribution and termination of your developer account." Guideline 2.5.19 mentions only App Store removal and account termination. It says nothing about alternative distribution.

The only place the term "bait-and-switch" appears on the guidelines page is guideline 3.1.2, on subscriptions, which states that apps that "engage in bait-and-switch and scam practices" will be removed and their developers "may be removed from the Apple Developer Program." That sentence concerns subscription scams, not concealed features.

Section 5: trafficking and child exploitation

The news post says Apple has "updated Section 5 of the App Review guidelines to make clear that apps with such content will be removed from the App Store and blocked from alternative distribution." It describes "such content" as material facilitating "human trafficking or the exploitation of children (including child sexual abuse material)."

The introduction to Section 5 on the page reads: "In extreme cases, such as apps that are found to facilitate human trafficking and/or the exploitation of children, appropriate authorities will be notified and the apps will be removed from the App Store and blocked from alternative distribution."

The removal and blocking language matches. Two differences remain. The page does not use the phrase "child sexual abuse material"; it refers to "the exploitation of children". And the page says "appropriate authorities will be notified", a commitment the news post does not mention. Neither document names which authorities, nor in which jurisdictions.

The reference to alternative distribution has a regulatory background. Apple opened iOS to alternative app marketplaces in the European Union in January 2024 to comply with the Digital Markets Act, and the EU General Court upheld Apple's gatekeeper designation for the App Store and iOS on July 8, 2026. Apps outside the App Store still pass through Apple's notarization process, which is how Apple can block them. The Section 5 language makes that block explicit for the most serious category of content, although the page frames it as applying "in extreme cases".

The enforcement numbers

Apple attaches two figures to the update. "Last year, we prevented over 150K apps with safety issues from reaching customers and terminated over 193K developer accounts for engaging in fraud and abuse," the post states. Neither figure is broken down by guideline, and the post does not say how many of those apps or accounts involved nonconsensual imagery or concealed features.

According to Apple, these violations "trace back to malicious actors - in some cases coordinated fraud operations - working to conceal harmful content that only becomes active once an app is approved." The post adds: "We do not hesitate to remove apps, and terminate the developers behind them, when they violate these guidelines."

The figures are Apple's own and are not independently verified. "Last year" is not defined, though it most likely refers to calendar year 2025.

Why the update arrives now

Apple's post does not cite any outside event. The pressure, however, is public. According to Engadget, San Francisco City Attorney David Chiu sent cease-and-desist letters to Apple and Google in July 2026, asking them to remove 13 AI nudification apps. Apple told the publication it had removed three of the apps and was terminating their developer accounts. Engadget also cited a Tech Transparency Project report from earlier in 2026, which found that nudification apps often passed review at both companies.

The wider AI imagery problem has been building for months. Users documented Grok generating sexualized images of minors from December 25, 2025, and the European Commission opened a formal investigation into X over Grok on January 26, 2026, covering manipulated sexually explicit images and potential child sexual abuse material. Search engines moved earlier: Google partnered with StopNCII on September 17, 2025 to use hash matching against known intimate images, and simplified its removal process for non-consensual explicit images on February 10, 2026.

Apple's own device-level tools have moved in parallel. Its Communication Safety feature blurs nudity in images sent to or received by children. But on-device filtering does nothing about apps whose entire purpose is to produce a deepfake of a real person, which is the gap the App Review language targets.

What it means for advertisers and app marketers

The App Store is a large advertising environment. In-app advertising accounted for $151 billion of the $1.4 trillion in billings and sales Apple attributed to the App Store ecosystem in 2025, and the store reached more than 850 million average weekly users. Every app that passes review and then switches on undisclosed features is also an ad placement whose content was never what the buyer saw. For brands buying in-app inventory through networks, the bait-and-switch problem is a brand safety problem: an app classified one way at review can serve ads next to content that would never have passed.

Enforcement under 1.2 can also hit large, legitimate apps. Apple removed Telegram from the App Store overnight into August 4, 2026, and reinstated it within hours, after, according to Pavel Durov, an attacker planted AI-modified illegal content in an old message. The remediation sequence now set out on the guidelines page, with a request, a plan and possible temporary removal, describes a process. It does not say how fast each step happens.

Apple's age-related rules form the other half of this picture. A social media question in the age rating questionnaire, added on July 9, 2026, sets a minimum 13+ rating for apps that answer yes, with answers mandatory from September 2026. Combined with the 1.2 changes, apps with user-generated content face both a rating floor and an explicit duty to remove nonconsensual imagery.

For app developers running user acquisition campaigns, the move of the hidden-features sentence into 2.5.19 is worth noting precisely because of the penalty attached. Under the old placement in 2.3.1(a), the consequence clause was attached to misleading marketing. Under 2.5.19, the hiding itself is "grounds for removal of your app from the App Store and termination of your developer account." Feature flags and staged rollouts are standard practice in app development, and the guideline does not distinguish between a remotely toggled experiment and a concealed nudification tool. Guideline 2.3.1(a) requires that new features be "described with specificity" in Notes for Review, which is the mechanism that separates the two. Will reviewers draw that line consistently? Neither document says.

The update lands a few days after Apple revised its developer agreement on October 13, 2026, and roughly eleven months after the November 2025 guideline revision. Apple did not set an effective date in the news post. The guidelines page carries the October 16 date and no transition period.

Timeline

Summary

Who: Apple, which operates the App Store and reviews every app submitted to it, and the developers who distribute apps through the App Store or alternative distribution.

What: Revisions to the App Review Guidelines. Guideline 1.2 now names nonconsensual intimate imagery and AI content creation apps, with a stepped remediation process. A new guideline 2.5.19 carries the existing ban on hidden, dormant or undocumented features, which Apple describes as targeting bait-and-switch apps, with removal and account termination as penalties. Section 5 says apps facilitating trafficking or child exploitation will be removed and blocked from alternative distribution. Apple's news post and the guidelines page differ on several phrases, including "proactively", "imagery generated using AI tools" and "child sexual abuse material", which appear only in the post.

When: Published October 16, 2026, with no separate effective date given.

Where: The App Store worldwide and, for Section 5, alternative distribution channels outside the App Store.

Why: According to Apple, to strengthen existing protections as new risks emerge, including apps that conceal nudification features until after approval. The update follows public pressure on app stores over AI nudification apps and coincides with Apple's claim that it blocked over 150,000 apps with safety issues and terminated over 193,000 developer accounts last year.