Apple App Review Rules: AI Nudify Apps and Hidden Features

What actually changed on October 16

Start with what Apple insists did not change. In its developer post, "Strengthening App Review Guidelines against nonconsensual intimate imagery and bait-and-switch apps", the company says pornographic material has long been prohibited on the App Store, and that the existing ban already covered apps that generate nudity or sexually explicit imagery, including "nudification" apps that create explicit images of real individuals without their consent. Anyone reporting October 16 as the day Apple banned nudify apps for the first time is contradicting Apple's own text.

The rewrite is in the obligations around that ban. Guideline 1.2, the user-generated content rule, now describes its scope as apps that let people "create, generate, upload, share, or otherwise contribute content", lists nonconsensual intimate imagery alongside intellectual property infringement and anonymous bullying as a defining risk of that category, and names AI content creation apps directly. Apple's post puts the duty in active terms: this imagery, "including imagery generated using AI tools", is content apps "must proactively prevent and remove". The four standing requirements for these apps — a filter for objectionable material, a reporting mechanism with timely responses, a way to block abusive users, and published contact information — are unchanged.

The consequence around those duties is stated more sharply than before. A developer who fails to implement appropriate safeguards, or fails to fix identified violations after notice, may now be treated as violating the Developer Code of Conduct, and Apple repeats in the guideline that egregious or repeated behaviour is grounds for removal from the App Store and from the Developer Program. That "may" is doing real work: the consequences are discretionary, not automatic. Apple emphasizes that the underlying conduct was already prohibited, and the distinction matters because the October update clarifies how developers must prevent violations and how Apple may respond, rather than creating the prohibition from scratch. What the clarified wording gives Apple is an explicit written basis for treating inadequate safeguards as a question about the developer — potentially exposing them to consequences beyond the removal of a single app — instead of only a defect in one listing. That is leverage usable against a company with many apps, or one large one, if Apple chooses to use it.

The second rule is about the review itself

The companion change has little to do with imagery and a lot to do with how apps pass review. New guideline 2.5.19 reads: "Don't include any hidden, dormant, or undocumented features in your app; your app's functionality should be clear to end users and App Review. Attempting to hide undocumented features in your app binary, such as through code obfuscation or other methods, is grounds for removal of your app from the App Store and termination of your developer account."

Two precisions matter here. First, the provision is general. It applies to every app category, not only to AI apps or nudify apps; Apple's announcement frames it around bait-and-switch — apps that, in Apple's words, "misrepresent their purpose during review and only reveal harmful capabilities — such as 'nudification' — after approval" — but the numbered rule itself is about concealed functionality anywhere. Second, obfuscation is not prohibited as a technique. It has legitimate uses, including protecting intellectual property and slowing reverse engineering. What 2.5.19 targets is using obfuscation, or any other method, to conceal undocumented features from App Review. And the prohibition itself is not new: Apple says the guideline clarifies a long-standing policy that previously sat inside guideline 2.3.1. Giving it a dedicated number makes Apple's position more explicit and easier to cite during enforcement. It does not create the underlying ban, and it will not end every dispute about what counts as undocumented.

The enforcement history behind this rule is large. In its 2025 App Store fraud prevention report, Apple said it removed nearly 59,000 apps that year for bait-and-switch changes — apps approved as ordinary games or utilities that later changed with intent to commit financial fraud — and rejected over 22,000 submissions for hidden or undocumented features. Those figures are about the whole bait-and-switch and hidden-feature categories, not about nudify apps, and they should stay in that lane. They still show the scale of the violation class the numbered rule addresses.

Section 5 received the third edit, and its wording is exact: apps found to facilitate human trafficking or the exploitation of children will be removed from the App Store and blocked from alternative distribution. The alternative-distribution half of that sentence is the new part, and it reaches the third-party marketplaces Apple has been required to allow, most visibly in the EU.

The October 16 revision was wider than these three areas. Apple's changelog also added, among other unrelated changes, guideline 2.3.14 on the creative assets developers can show on product pages. Nothing in this article should be read as the complete changelog.

The pressure behind the timing

The timing has a record. The Tech Transparency Project reported nudify apps available on the App Store in January 2026. In July, San Francisco's city attorney ordered Apple to remove eight iPhone apps of this kind, per AppleInsider's account. And the largest app associated with the problem is not a small nudify tool. MacRumors reports that earlier this year Apple told xAI it would remove Grok from the App Store if the app kept permitting nude deepfakes, and that Apple approved an updated version after xAI added safeguards. Apple's October posts name no app, and nothing in them announces action against Grok or X. Any claim that this update is aimed at a specific app is a reading of the context, not something Apple said.

That restraint is also the limit of the announcement. A written duty to prevent imagery proactively is only as real as the testing behind it, and Apple published no new testing method, no transparency figures for this category, and no list of apps removed under the new wording. "We do not hesitate to remove apps, and terminate the developers behind them, when they violate these guidelines," the post says. The evidence for that sentence will be the first removals that cite 1.2 or 2.5.19 by number.

What to watch

Three things will show whether October 16 changed behaviour or only wording. First, whether App Store removals start citing the new guideline numbers, which would signal reviewers are using them as the operative standard. Second, whether the proactive-prevention duty is applied to large general-purpose AI apps with the same force as to small single-purpose ones; the Grok episode earlier this year ended in a private warning and an updated app, not a removal. Third, whether the alternative-distribution block in Section 5 is ever invoked, since that is the part of the package that reaches beyond Apple's own store.

Developers shipping AI image tools on iOS do not need to wait for those answers. Their category is now named in 1.2, the safeguards are enumerated, and a feature that is concealed from App Review, or appears only after approval, puts the developer account itself in play under 2.5.19 — subject, as all of these consequences are, to Apple's discretion in applying them.

Sources

[1] Apple Developer News, "Strengthening App Review Guidelines against nonconsensual intimate imagery and bait-and-switch apps," October 16, 2026 — Apple's explanatory post (primary; text as reproduced by Daring Fireball, MacObserver and MacRumors)Read source
[2] Apple Developer News, "Updated App Review Guidelines are now available," October 16, 2026 — Apple's changelog (1.2 clarified; 2.3.14 new; 2.5.19 new, clarifying policy formerly in 2.3.1; Section 5 alternative distribution), as reproduced in fullRead source
[3] 9to5Mac, "Apple's new App Store rules crack down on AI nudification and 'bait-and-switch' apps," October 16, 2026 — guideline 1.2 and 2.5.19 text as published by AppleRead source
[4] Engadget, "Apple updates App Store rules to ensure it doesn't offer AI nudify apps," October 17, 2026 — coverage of the update and of MacRumors' reporting on Apple's earlier-this-year warning to xAI over GrokRead source
[5] AppleInsider, "Generative AI porn apps targeted in App Review Guidelines update," October 17, 2026 — San Francisco's July order that Apple remove eight appsRead source

THE ALFW VERDICT

Apple did not newly prohibit nudification apps on October 16, and the update should not be read as a new ban. What it does is make an existing framework harder to argue with: AI content creation is named in the moderation requirements, prevention of nonconsensual intimate imagery is stated as a proactive duty, concealing functionality from App Review is addressed in its own numbered guideline, the possible consequences for developers are clarified as discretionary Code of Conduct exposure rather than automatic penalties, and the trafficking and child-exploitation provisions now expressly reach alternative distribution. These are meaningful enforcement clarifications, not proof of stronger enforcement. Apple accompanied them with no named removals, no new testing method and no figures for this category. The measure of the update is whether the clarified duties are applied as consistently to large general-purpose AI platforms as to small single-purpose apps.