Apple's App Review Guidelines section 1.2 says apps that let users create, upload, share or contribute content must include a method for filtering objectionable material, a mechanism to report offensive content with timely responses, the ability to block abusive users, and published contact information. That applies to any app with a user-facing marketplace of listings or posts.
The four requirements
From the guideline text:
- Filtering. A method for filtering objectionable material from being posted.
- Reporting. A mechanism to report offensive content, with timely responses to concerns.
- Blocking. The ability to block abusive users from the service.
- Contact. Published contact information so users can easily reach you.
The guideline adds that you are responsible for removing violating content, and repeated or egregious behaviour can lead to removal from the App Store and the Developer Program.
Why a plugin or extension marketplace should care
If your product lets third parties publish listings, reviews or comments and you ship an iOS app, you are in the UGC category. Even if you do not, the four requirements are a good minimum for any vendor run store, because they are the same controls a security team wants for malicious listings.
| Apple requirement | Security equivalent for a marketplace |
|---|---|
| Filtering | Automated checks at publish: malware scan, lookalike names |
| Reporting | A report link on each listing and a response target |
| Blocking users | Suspending a publisher account and its tokens |
| Contact information | A security contact for reporters and researchers |
Implementation notes
- Reporting should be one tap from the content. Hidden menus lead to unreported abuse.
- Acknowledge reports. A message that says the report arrived keeps reporters coming back.
- Block must be effective. Blocking an account should also end its sessions and revoke its tokens.
- Record decisions. Keep what was reported, what you decided and when. You will need it for appeals and for App Review questions.
- Test before you submit. Reviewers try the report and block paths.
Where this overlaps with privacy rules
Section 5.1 asks for a privacy policy within the app and App Store Connect metadata, consent for collecting user or usage data, and data minimisation. A reporting flow collects data about both reporter and reported user, so describe it in your policy and keep only what you need for the decision.
Process questions for your team
- Who reads reports, and how fast?
- What is the severity order? Harm to users first, then impersonation, then spam.
- When does content get removed before review finishes?
- How do you handle a repeat offender?
- What do you tell the reporter afterwards?
Answer these in writing before launch. They are also what an auditor asks when you pursue a compliance programme later.
Safeguard's compliance and evidence automation can hold such records alongside other control evidence.
Quick check
Does guideline 1.2 apply only to social apps?
No. It applies to apps that let users create, upload, share or contribute content, including UGC platforms and AI content creation apps.
What happens if I do not remove violating content?
The guideline says you are responsible for removal and repeated or egregious behaviour can lead to removal from the App Store and the Developer Program.
Is contact information required?
Yes. Published contact information is one of the four listed requirements.
Sources
Last reviewed: 19 October 2026.
