One of the common reasons for rejection in App Store and Google Play reviews is the lack or incorrect implementation of Privacy Policy and Terms of Service screens. Over 60% of apps contacting us have issues with consent screens. We have helped 50+ projects pass review on the first try. Apple requires an active link to the Privacy Policy in Store Connect, Google Play in the developer console. Inside the app, the link must be accessible when requesting contacts, photos, or camera. Non-compliance with GDPR risks fines up to €20 million or 4% of annual turnover. The consent screen on first launch must not use dark patterns: the "Accept" button activates only after full scroll of the document.
"Apps that collect personal data must provide a clearly displayed privacy policy." — App Store Review Guidelines 5.1.1
What problems we solve
Rejection during review due to missing policy links
App Store and Google Play block apps without active links to Privacy Policy and TOS (if there are IAPs, registration, or data collection). We check all points: Store Connect, Console, and in-app screens. In 95% of cases, the problem is solved by adding the link in the right places.
Dark patterns and GDPR/CCPA compliance
The first-launch screen must not be designed to force consent. We implement scroll activation and explicit acceptance of each document separately. The average success rate of GDPR audit after our revision is 100%.
Versioning and legal validity of consent
We store acceptance with document version and timestamp. When the document is updated, re-acceptance is required only for material changes — this is recorded on the server. In 3 years of work, none of the 50+ projects have been fined.
How we do it: stack and use cases
Stack
- iOS: Swift 5.9, async/await, WKWebView, URLCache, Core Data for caching.
- Android: Kotlin, Coroutines, WebView, OkHttp cache, Room for storage.
- Flutter/React Native: on request — we adapt to the framework.
Case: consent screen implementation with offline access
// iOS: load policy with fallback on cache and bundled class PolicyDocumentLoader { func loadPolicy(_ type: PolicyType) async -> PolicyDocument { // Try fresh version from server if let fresh = try? await fetchFromServer(type) { cache.save(fresh, for: type) return fresh } // Fallback on local cache if let cached = cache.load(for: type) { return cached } // Last resort — bundled from app return loadBundled(type) } } Bundled version is embedded at release time and always available on first launch. For Android similarly:
// Android: similar pattern with OkHttp cache fun loadPolicy(type: PolicyType): PolicyDocument { return try { fetchFromServer(type).also { cache.save(it) } } catch (e: Exception) { cache.load(type) ?: loadBundled(type) } } Example deep link to policy section
For compliance, it is often required to open a specific section of the policy (e.g., #camera-section). We support URL fragments in WebView.| Parameter | WebView | Native rendering |
|---|---|---|
| Update flexibility | High (no release) | Low (only via build) |
| Offline access | With caching | Automatic |
| Deep linking | Supports fragments | Requires parsing |
How to avoid rejection during review?
Check that:
- Link to Privacy Policy is in Store Connect / Console.
- Inside the app, the link is accessible when requesting contacts, photos, camera, etc.
- Consent screen does not use pre-ticked checkboxes — explicit action is required.
- Acceptance is recorded with document version.
What to do when the document is updated?
- Change the document version on the server.
- On login, check
lastAcceptedVersionfor the user. - If new version is materially different — show re-acceptance screen.
- Record acceptance with the new version.
Process of work
| Stage | Duration |
|---|---|
| Requirements analysis | 0.5 day |
| Screen design | 0.5 day |
| Implementation (WebView + cache + logging) | 1-2 days |
| Testing (network off, scroll, deep link) | 1 day |
| Deployment and review consultation | 0.5 day |
Timelines are indicative: from 2 to 5 days. Cost is calculated individually. Order an audit of your app — we will check consent compliance with App Store and Google Play requirements. Contact us for a consultation on passing review.
What is included in the work
- Document loading module with caching.
- Consent screen with scroll tracking.
- Backend structure for storing acceptance version.
- Documentation on versioning.
- Consultation on passing review.
Typical mistakes in self-implementation
- No separate checkbox for each document (Privacy and TOS).
- Document version is not stored — consent loses legal force.
- "Accept" button active immediately — violates consent requirements.
- No offline handling — user cannot accept without network.
WebView with caching provides update flexibility 3 times faster compared to native layout. Our experience guarantees passing review on the first try. Get a consultation for your project.