Apple rewrote three parts of its App Store rulebook on Friday, October 16, and the biggest change puts AI-generated nude deepfakes squarely on developers’ to-do lists. Any app that lets people create, generate, upload or share content must now actively stop and take down nonconsensual intimate imagery, including pictures made with AI tools, or risk being pulled from the store.
Apple’s developer note was blunt about enforcement: “We do not hesitate to remove apps, and terminate the developers behind them, when they violate these guidelines.”
The three changes, in plain terms
- Rule 1.2 (user content): Nonconsensual intimate imagery is now named alongside copyright infringement and anonymous bullying as a known problem for content apps. Developers who lack proper safeguards, or who fail to fix a violation once Apple flags it, can be treated as breaking the Developer Code of Conduct and removed.
- Rule 2.5.19 (new): No hidden, dormant or undocumented features. Burying functions in an app’s code, for instance through obfuscation, is now spelled out as grounds for removing the app and closing the developer’s account. A similar ban already sat in rule 2.3.1; the new wording names the technique and the penalty.
- Section 5 (legal): Apps that facilitate human trafficking or child exploitation were already banned. Apple now states that such apps will also be blocked from alternative distribution, not only from the App Store itself.
The second rule targets what Apple calls “bait-and-switch”: an app that looks harmless when it goes through review and switches on a “nudification” feature, which turns photos of real people into explicit images without their consent, only after approval. Apple says those apps were never allowed; the new rule makes the consequence explicit for the person behind them, not just the app.
Why now
The update closes a year of pressure. In January, the watchdog group Tech Transparency Project said it had found dozens of AI “nudify” apps in the App Store, and a follow-up in April said store search suggestions and ads were steering users toward them. Separate reporting in July described apps posing as simple games that revealed betting platforms only when opened from Brazilian internet addresses, which is the bait-and-switch pattern in a different form.
There is also a legal backdrop in the US. The TAKE IT DOWN Act gave covered platforms until May 19, 2026, to set up a way for people to request removal of intimate images posted without consent, and to take those images and known identical copies down within 48 hours of a valid request, according to the Federal Trade Commission. Before that date arrived, FTC Chairman Andrew Ferguson wrote to 15 companies, Apple among them, reminding them to comply. Apple’s new rule pushes a similar duty one level down, onto the developers whose apps run on its phones.
The scale Apple is policing
Apple says that last year it stopped more than 150,000 apps with safety problems from reaching customers and terminated more than 193,000 developer accounts for fraud and abuse. Spread across 365 days, that works out to roughly 411 blocked apps and about 529 closed developer accounts every day. Apple says many of those cases involved organized groups hiding harmful content that only activates once an app is approved, which is the exact gap rule 2.5.19 is written to close.
What it means if you use an iPhone
You will not see a settings change or a software update from this. The rules govern developers, so the effect shows up in which apps stay available and how they behave. Three practical points follow from Apple’s existing requirements and the new text:
First, any app that hosts user content is already required to filter objectionable material, let you report offensive posts and let you block abusive accounts. If an app has no report or block option, that is itself a breach of Apple’s rules. Second, Apple’s removal threat applies when a developer ignores a flagged violation, so reports made through an app’s own tools matter. Third, the new section 5 wording means an app thrown out of the App Store for exploiting children cannot simply move to a different distribution route on Apple devices.
Anyone in the US whose intimate images are shared without consent, and whose removal request a platform ignores, can file a complaint with the FTC at TakeItDown.ftc.gov, the site the agency opened when enforcement began. Covered platforms have 48 hours from a valid request to act.
Further reading
Image: Nils Huenerfuerst, CC0 via Wikimedia Commons
This article was produced with AI assistance and reviewed by our Editorial Desk. How we work.
