Apple tweaks App Store rule changes for children’s apps and sign in services

Originally announced in June, changes to Apple's App Store policies on its Sign in with Apple service and the rules around children's app categories are being tweaked. New apps must comply right away with the tweaked terms, but existing apps will have until early 2020 to comply with the new rules.

The changes announced at Apple's developer conference in the summer were significant, and raised concerns among developers that the rules could handicap their ability to do business in a universe that, frankly, offers tough alternatives to ad-based revenue for children's apps.

In a short interview with TechCrunch, Apple's Phil Schiller said that they had spent time with developers, analytics companies and advertising services to hear what they had to say about the proposals and have made some updates.

The changes are garnering some strong statements of support from advocacy groups and advertising providers for children's apps that were pre-briefed on the tweaks. The changes will show up as of this morning in Apple's developer guidelines.

"As we got closer to implementation we spent more time with developers, analytics companies and advertising companies," said Schiller. "Some of them are really forward thinking and have good ideas and are trying to be leaders in this space too."

With their feedback, Schiller said, they've updated the guidelines to allow them to be more applicable to a broader number of scenarios. The goal, he said, was to make the guidelines easy enough for developers to adopt while being supportive of sensible policies that parents could buy into. These additional guidelines, especially around the Kids app category, says Schiller, outline scenarios that may not be addressed by the Children's Online Privacy Protection Act (COPPA) or GDPR regulations.

There are two main updates.

Kids changes

The first area that is getting further tweaking is the Kids terms. Rule sections 1.3 and 5.1.4 specifically are being adjusted after Apple spoke with developers and providers of ad and analytics services about their concerns over the past few months.

Both of those rules are being updated to add more nuance to their language around third-party services like ads and analytics. In June, Apple announced a very hard-line version of these rule updates that essentially outlawed any third-party ads or analytics software and prohibited any data transmission to third-parties. The new rules offer some opportunities for developers to continue to integrate these into their apps, but also sets out explicit constraints for them.

The big changes come in section 1.3 surrounding data safety in the Kids category. Apple has removed the explicit restriction on including any third-party advertising or analytics. This was the huge hammer that developers saw heading towards their business models.

Instead, Apple has laid out a much more nuanced proposal for app developers. Specifically, it says these apps should not include analytics or ads from third parties, which implicitly acknowledging that there are ways to provide these services while also practicing data safety on the App Store.

Apple says that in limited cases, third-party analytics may be permitted as long as apps in the Kids category do not send personal identifiable information or any device fingerprinting information to third parties. This includes transmitting the IDFA (the device ID for advertisers), name, date of birth, email address, location or any other personally identifiable information.

Third-party contextual ads may be allowed but only if those companies providing the ads have publicly documented practices and policies and also offer human review of ad creatives. That certainly limits the options, including most offerings from programmatic services.

Rule 5.1.4 centers on data handling in kids apps. In addition to complying with COPPA, GDPR and other local regulations, Apple sets out some explicit guard rails.

First, the language on third-party ads and analytics has been changed from may not to should not. Apple is discouraging their use, but acknowledges that "in limited cases" third-party analytics and advertising may be permitted if it adheres to the new rules set out in guideline 1.3.

The explicit prohibition on transmitting any data to third parties from apps in the Kids category has been removed. Once again, this was the big bad bullet that every children's app maker was paying attention to.

An additional clause reminds developers not to use terms like "for kids" and "for children" in app metadata for apps outside of the Kids category on the App Store.

SuperAwesome is a company that provides services like safe ad serving to kids apps. CEO Dylan Collins was initially critical of Apple's proposed changes, noting that killing off all third-party apps could decimate the kids app category.

"Apple are clearly very serious about setting the standard for kids apps and digital services," Collins said in a statement to TechCrunch after reviewing the new rules Apple is publishing. "They've spent a lot of time working with developers and kidtech providers to ensure that policies and tools are set to create great kids digital experiences while also ensuring their digital privacy and safety. This is the model for all other technology platforms to follow."

All new apps must adhere to the guidelines. Existing apps have been given an additional six months to live in their current form but must comply by March 3, 2020.

"We commend Apple for taking real steps to protect children's privacy and ensure that kids will not be targets for data-driven, personalized marketing," said Josh Golin, Executive Director of Campaign for Commercial-Free Childhood. "Apple rightly recognizes that a child's personal identifiable information should never be shared with marketers or other third parties. We also appreciate that Apple made these changes on its own accord, without being dragged to the table by regulators."

The CCFC had a major win recently when the FTC announced a $170M fine against YouTube for violations of COPPA.

Sign in with Apple

The second set of updates has to do with Apple's Sign in with Apple service.

Sign in with Apple is a sign-in service that can be offered by an app developer to instantly create an account that is handled by Apple with additional privacy for the user. We've gone over the offering extensively here, but there are some clarifications and policy additions in the new guidelines.

Sign in with Apple is being required to be offered by Apple if your app exclusively offers third-party or social log ins like those from Twitter, Google, LinkedIn, Amazon or Facebook. It is notrequired if users sign in with a unique account created in the app, with say an email and password.

But some additional clarifications have been added for additional scenarios. Sign in with Apple will not be required in the following conditions:

• Your app exclusively uses your company's own account setup and sign-in systems.
• Your app is an education, enterprise or business app that requires the user to sign in with an existing education or enterprise account.
• Your app uses a government or industry-backed citizen identification system or electronic ID to authenticate users.
• Your app is a client for specific third-party service and users are required to sign in to their mail, social media or other third-party account directly to access their content.

Most of these were sort of assumed to be true but were not initially clear in June. The last one, especially, was one that I was interested in seeing play out. This scenario applies to, for instance, the Gmail app for iOS, as well as apps like Tweetbot, which log in via Twitter because all they do is display Twitter.

Starting today, new apps submitted to the store that don't meet any of the above requirements must offer Sign in with Apple to users. Current apps and app updates have until April 2020 to comply.

Both of these tweaks come after developers and other app makers expressed concern and reports noted the abruptness and strictness of the changes in the context of the ever-swirling anti-trust debate surrounding big tech. Apple continues to walk a tightrope with the App Store where they flex muscles in an effort to enhance data protections for users while simultaneously trying to appear as egalitarian as possible in order to avoid regulatory scrutiny.