/apple-legal-max

name: apple-legal-max
description: Legal and privacy compliance for Apple-platform apps (iOS/iPadOS/macOS/watchOS/tvOS/visionOS). Use this skill WHENEVER a task touches - privacy policy, terms of service, ToS, EULA, license agreement, privacy manifest, PrivacyInfo.xcprivacy, required reason APIs, App Tracking Transparency, ATT, IDFA, tracking domains, privacy nutrition labels, App Privacy details, GDPR, CCPA/CPRA, US state privacy laws, COPPA, kids apps, children's privacy, age ratings, account deletion requirements, data deletion, export compliance, encryption declarations, ITSAppUsesNonExemptEncryption, France ANSSI declaration, EU DMA, alternative app marketplaces, web distribution, external purchase links, DSA trader status, subscription legal terms, or auto-renewal disclosures. Also use when drafting or reviewing ANY legal document or App Store Connect privacy/legal field for an app, when adding an SDK that collects data, or when a user asks "what legal stuff does my app need?" Sibling skill app-review-max owns App Review rejection mechanics; this skill owns the law and Apple's privacy/legal rules themselves.

Apple Legal Max — Legal & Privacy Compliance for Apple-Platform Apps

Everything a shipping Apple-platform app must have to be legally and policy-compliant: Apple's enforced privacy rules, the regulations that actually apply, and the documents the app needs. Cite the governing rule (App Review Guideline number or regulation article) for every requirement you state.

**MANDATORY FRAMING — tell the user this once per conversation, early:** "I'm not a lawyer and this isn't legal advice. This is engineering-grade compliance guidance based on Apple's published rules and the text of the regulations; have counsel review anything you'll actually publish or rely on — especially for kids' apps, health/financial data, or EU/regulated markets."

Fast-moving areas (EU DMA fees, US state age-verification laws, India DPDP) are marked **[as of July 2026 — verify]**. When one is load-bearing for the user's decision, re-verify against developer.apple.com before answering.

Reference files — load on demand

| File | Load when | |---|---| | `references/privacy-manifests.md` | PrivacyInfo.xcprivacy, required reason APIs, tracking domains, SDK manifests, nutrition-label aggregation | | `references/regulations-for-apps.md` | GDPR, CCPA/US states, COPPA/kids, DPDP, EU DMA/DSA, export compliance & France | | `references/document-templates.md` | Drafting privacy policy / ToS / EULA / subscription terms; where each URL goes in App Store Connect |

Compliance map — what applies when

Walk the app through these questions. Each "yes" pulls in obligations:

| Question | If YES, applies | Governing rules | |---|---|---| | Does the app (or any SDK in it) collect ANY data? | Privacy policy, accurate nutrition labels, privacy manifest data-type entries | Guideline 5.1.1(i), 5.1.2(i); App Privacy details | | Does it **track** (link user/device data with third-party data for ads or share with data brokers)? | ATT prompt before tracking, `NSPrivacyTracking=true`, tracking domains declared, "Data Used to Track You" label | Guideline 5.1.2; ATT framework docs | | Account creation in-app? | In-app account **deletion** (not just deactivation), discoverable, initiates full deletion | Guideline 5.1.1(v) | | Third-party/social login offered? | Must also offer Sign in with Apple or an equivalent privacy-focused option | Guideline 4.8 | | Made **for kids** or targets children? | Kids Category rules, no third-party ads/analytics (narrow exceptions), COPPA (US), GDPR Art 8 (EU), parental gates | Guidelines 1.3, 5.1.4; COPPA Rule (amended, in force) | | Auto-renewable subscriptions? | Full auto-renew disclosure in app + metadata, ToS/EULA link in app AND App Store metadata, privacy policy link | Guideline 3.1.2; state auto-renewal laws (CA ARL etc.) | | Health, fitness, or medical data? | HealthKit rules, no ads from health data, research consent; HIPAA only if a covered entity/BA; WA My Health My Data | Guidelines 5.1.3, 1.4.1; RCW 19.373 | | Uses ANY encryption (incl. HTTPS)? | Export compliance answer every build; France ANSSI declaration if non-exempt crypto and distributing in France | `ITSAppUsesNonExemptEncryption`; US EAR; French decree 2007-663 | | Distributed in the EU? | GDPR, DSA **trader status** (mandatory since Feb 2025 — no trader status = removed from EU App Store), DMA options (alt marketplaces, web distribution, external purchase links) | GDPR; DSA Art 30/31; Apple DMA terms **[as of July 2026 — verify fees]** | | Distributed in the US? | ~19–20 state comprehensive privacy laws in force (CA, VA, CO, CT, UT, TX, OR, MT, FL, DE, IA, NE, NH, NJ, TN, MN, MD, IN, KY, RI); GPC honoring in ~12 states | See regulations reference | | Any SDK from Apple's "commonly used SDKs" list? | SDK must ship its own privacy manifest + signature | developer.apple.com third-party SDK requirements | | User-generated content? | Moderation, blocking, reporting, contact info | Guideline 1.2 |

The non-negotiables Apple itself enforces

These are rejection/removal triggers regardless of what any law says:

1. **Privacy policy URL — always required, every app.** In App Store Connect metadata AND accessible within the app. Must state what's collected, how used, third-party sharing (and that those parties give equal protection), retention/deletion, and how to revoke consent. — 5.1.1(i) 2. **Account deletion if account creation.** In-app initiation of *deletion* (deactivation is not enough). Highly regulated industries may use extra confirmation steps but the entry point must be in the app. — 5.1.1(v) 3. **ATT before any tracking.** No fingerprinting, no "we'll track anyway via server-side matching." Declared `NSPrivacyTrackingDomains` are network-blocked until the user grants ATT permission. Denied ATT ≠ degraded core functionality. — 5.1.2, 2.3.1 4. **Nutrition label accuracy.** Labels must match actual behavior *incl