App Store & Google Play Legal Requirements: Tracking, Kids Apps & Subscriptions

Our first guide to listing an app on Google Play and the App Store covered developer accounts, privacy policies, and content rights. It also explained regulated categories such as crypto and gambling. Four other requirements deserve separate attention: tracking consent, encryption exports, children’s apps, and subscriptions. Each can trigger rejection on its own. The applicable rules depend on the features your app provides. Read Part 1: App Store & Google Play Legal Requirements (2026)

The discussion draws on Apple, Google, and FTC guidance reviewed on October 1, 2026.

Tracking consent: App Tracking Transparency and the privacy label

Apple introduced App Tracking Transparency (ATT) with iOS 14.5. Apps need permission to track users or access the advertising identifier. Apple’s definition includes: “linking user or device data collected from your app with user or device data collected from other companies’ apps, websites, or offline properties for targeted advertising or advertising measurement purposes,” It also covers sharing data with data brokers (Apple Developer: App Tracking Transparency, reviewed September 29, 2026).

When ATT consent is required

ATT can apply beyond obvious advertising networks:

• Third-party SDKs count even when you don’t use them for tracking. ATT can apply when an SDK combines your app’s data with other apps’ data for advertising or measurement. Apple says this applies “even if you don’t use the SDK for these purposes.” A crash-reporting SDK may also trigger ATT if it performs cross-app attribution.
• You can’t gate features on consent. Guideline 5.1.2(i) prohibits conditioning app functionality on tracking consent. Guideline 5.1.1(iv) also prohibits manipulating users into agreeing.
• You’re responsible for code you didn’t write. Apple states: “Developers are responsible for all code included in their apps,” This responsibility includes SDKs that track without the developer’s knowledge.

Privacy labels and third-party SDKs

Every app also needs a privacy “nutrition label” in App Store Connect. Disclose the data collected, its tracking uses, and links to users or devices. Apple requires privacy manifests from certain third-party SDKs. These documents support accurate disclosures. Google also requires a Data safety form. Its declarations must reflect actual SDK behavior, not assumptions.

Accuracy matters more than checking a box. A “no tracking” label is inaccurate when an embedded SDK performs cross-app attribution. Such statements may also create consumer protection risks.

Export compliance: encryption and US export controls

Export compliance concerns US law rather than app content. Apple requires developers to declare their app’s encryption use before release. The process relates to US Export Administration Regulations (EAR). The US Bureau of Industry and Security administers those rules.

How to declare encryption

Start with the 'ITSAppUsesNonExemptEncryption' setting in your app configuration. Use 'NO' for no encryption or encryption exempt from documentation. Apple’s built-in operating-system encryption is a common example. Use 'YES' for non-exempt encryption. This may trigger additional documentation. Apps using standard encryption outside Apple’s OS may need a French declaration when distributed in France. For proprietary algorithms, Apple lists a US Commodity Classification Automated Tracking System (CCATS) submission. French distribution may also require a French declaration (Apple Developer, reviewed September 29, 2026).

When additional documentation matters

Many apps qualify for exemptions through standard encryption, including TLS network connections. Check the encryption used by third-party dependencies before answering. A fintech or crypto app may implement its own cryptographic signing. Others include non-standard encryption libraries. These features warrant closer export review because incorrect declarations can carry significant risks.

Apps for children: the Kids Category, Google Play Families, and COPPA

Children’s privacy rules span platform policies and US federal law. Violations can bring substantial penalties.

Apple Kids Category rules

Apple’s Kids Category, falls under Guideline 1.3. It restricts external links, purchase options, and distractions unless a parental gate protects them. Kids Category apps “may not send personally identifiable information or device information to third parties” Third-party analytics and advertising are generally restricted. Some analytics and contextual advertising qualify for limited exceptions. These depend on the data collected and the provider’s age-appropriate practices (App Review Guidelines, reviewed September 29, 2026).

Google Play Families policy

Google Play Families policies cover child-directed apps and apps likely to attract children. Developer intent alone does not decide applicability. Developers must declare their target audience and age groups in Play Console. Google warns that inaccurate declarations “may result in removal or suspension.” Child-directed apps must not transmit children’s advertising identifiers or precise location data. Advertising must use Google Play Families Self-Certified Ads SDKs where required. Google prohibits interest-based advertising and remarketing to children (Play Console Help, reviewed September 29, 2026).

COPPA and parental consent

COPPA sits underneath both platform policies as US federal law. With limited exceptions, operators need verifiable parental consent before collecting personal data from children under 13. The FTC defines personal information broadly. It includes names, contact details, and persistent identifiers that track users over time. It also includes photographs or audio of children and sufficiently precise geolocation data. FTC guidance cited a potential $53,088 civil penalty per violation in September 2026. Statutory limits can change. Actual penalties depend on the case, including its severity and the number of children affected.

Apps that may attract children

Google’s “likely to attract children” standard can surprise developers. Apple’s Kids Category also raises children’s privacy obligations. Intended audiences do not resolve every question about child-directed content. Cartoon characters or simple gameplay may attract child audiences. Broad targeting does not automatically exclude an app from review. Platforms assess the app’s actual characteristics.

Subscriptions: what has to be disclosed before someone pays

Both platforms allow auto-renewable subscriptions. Each imposes disclosure and cancellation requirements.

Apple: subscription disclosures

Apple’s Guideline 3.1.2(c) requires clear information before purchase. Users should understand exactly what their subscription includes. Apple gives examples: “how many issues per month,” “how much cloud storage,” “what kind of access to your service” (App Review Guidelines, retrieved 2026-09-29). Subscriptions must last at least seven days. Users should have access across their devices.

Guideline 3.1.2(a) prohibits apps that “trick users into purchasing a subscription under false pretenses,” or running “bait-and-switch and scam practices,” risk removal from the App Store. Apple may also terminate the developer’s program membership. Apple expects the full renewal price to stand out in the purchase flow. Free trials must clearly show their duration and the subsequent price.

Google Play: cancellation and price increases

Google Play requires an easy online cancellation method. Apps can direct users to Google’s Subscription Center or provide an accessible in-app flow. Google Play price increases follow an opt-in or opt-out process. Opt-in changes allow at least 30 days for consent. Eligible opt-out changes require 30 or 60 days’ advance notice, depending on the country. Google also requires prominent in-app notice for applicable opt-out increases. Show the subscription, both prices, the effective date, and cancellation instructions (Play Console Help, reviewed September 29, 2026).

SaaS subscriptions also face general consumer protection laws. Auto-renewal rules differ among US states and EU countries. The platform terms are a floor, not a substitute for that analysis.

What this means before you build the feature

One reading of the App Review Guidelines will not address every issue. Each issue can follow a feature decision. Examples include adding an ad SDK, custom encryption, a broad audience, or subscriptions. Review the requirements when deciding on features, before development ends.

Legal Kornet reviews privacy declarations, subscription terms, and children’s-app compliance. For SaaS products with recurring payments, see our guide to SaaS Subscription Agreements and their key legal provisions.

Frequently asked questions

• Does ATT apply if I don’t use ads at all?

  ATT consent generally isn’t needed when neither your app nor its SDKs engage in covered tracking. An overlooked third-party SDK is often the main risk.

• Do I need an export compliance declaration if I only use HTTPS?

  Operating-system encryption often qualifies for an exemption. This includes many standard HTTPS connections. You must still make an accurate declaration in App Store Connect. An exemption doesn’t eliminate that step.

• My app isn’t for kids, but kids might use it. Does Families policy still apply?

  Yes, potentially. Google’s policy can cover apps “likely to attract” children. Apple’s Kids Category rules apply to apps in that category. Assess general-audience apps with child-friendly characters, gameplay, or content. Do not automatically assume they fall outside children’s privacy rules.

• Can I just link to my website for subscription cancellation?

  Google Play permits an accessible cancellation flow, including a link to its Subscription Center. Apple provides account settings for subscription management. Both platforms scrutinize cancellation barriers, regardless of where a link points.

Talk to Us Before the Feature Ships