Business apps and in-house service apps published on the App Store are sometimes built in ways such as enabling new features from server settings after review, or leaving internal testing screens in the app. The App Review Guidelines revision of October 16, 2026 makes it necessary to review these approaches.
On that day, Apple announced the revision of the guidelines and added 2.5.19 as a new item.
2.5.19 Don’t include any hidden, dormant, or undocumented features in your app; your app’s functionality should be clear to end users and App Review.
Based on the two revision announcements and the original guideline text, this article lays out what staff responsible for developing and maintaining apps should check.
Main points of the revision
The main changes listed in the announcement are as follows.
- 2.5.19 (new): do not include hidden, dormant, or undocumented features in your app. This clarifies a policy previously found in 2.3.1
- 1.2: clarified which apps are covered as handling content that users create, generate, or post, and added that failing to provide appropriate safeguards may violate the Developer Code of Conduct
- 2.3.14 (new): an item about App Store "creative assets"
- 3.1.1(a): merged the music streaming entitlement item into the external purchase link entitlement item
- 5: clarified that apps facilitating human trafficking or child exploitation will be removed from the App Store and will also be barred from distribution outside the App Store (alternative distribution)
In addition, links to related materials were added to Before You Submit and After You Submit.
Another announcement on the same day cites, as background for the revision, the tactic of misrepresenting an app's purpose during review and releasing harmful features after approval (so-called "bait-and-switch"). The guidelines' last updated date is "October 16, 2026." Apple says translated versions will be published within one month. As of October 27, 2026, the Japanese version's last updated date was still June 8, 2026, and this revision had not yet been reflected.
What 2.5.19 requires
The full text of 2.5.19 is as follows.
2.5.19 Don’t include any hidden, dormant, or undocumented features in your app; your app’s functionality should be clear to end users and App Review. Attempting to hide undocumented features in your app binary, such as through code obfuscation or other methods, is grounds for removal of your app from the App Store and termination of your developer account.
In short, an app's features must be clear to both users and reviewers, and attempting to hide undocumented features in the binary, through obfuscation or other means, is grounds for removal of the app and termination of the developer account.
The announcement explains that 2.5.19 clarifies the ban on misrepresenting what an app does during review and changing it after approval. As an example, it cites "adding features that were not included in the version submitted for review."
Let us also check the related items.
- 2.3.1(a): describe new features and changes specifically in the Notes for Review in App Store Connect, and make them available for review. Generic descriptions will be rejected
- 2.5.2: apps must not download and execute code that adds or changes app features
- Before You Submit: explain non-obvious features and in-app purchases in detail in the Notes for Review. For apps that require an account, provide a demo account or a demo mode that gives access to all features
Implementation approaches worth reviewing
The guidelines do not directly say whether feature flags (mechanisms that turn features on or off through settings) or remote configuration themselves are allowed. The following is the editorial team's summary, based on the wording of 2.5.19 and related items, of implementation approaches worth checking.
- Enabling new features through server settings after review: can the reviewer verify the feature in the version submitted for review? Do the Notes for Review describe the feature and how to enable it?
- Internal testing screens and debug menus: are any left in the production version? If they must remain, are they presented in a way that users and reviewers can understand?
- Features visible only to certain users (only corporate customers, only administrators, and so on): can the reviewer verify those features with the demo account for review?
- Obfuscation: if you obfuscate to protect your source code, is it done in a way that will not be taken as intended to hide features?
Phased rollout mechanisms are themselves one way to maintain quality. Feature flag design is explained in Running feature flags with Cloudflare Flagship × OpenFeature. In light of the 2.5.19 revision, the editorial team suggests listing the features hidden behind flags and agreeing in advance with your outsourced vendor on how to describe them in the Notes for Review.
Apps that create images or text with AI (1.2)
1.2 is the item for apps where users create, generate, or post content. The revised text names "social media, user-generated content platforms, and AI content creation apps" as covered, and adds nonconsensual intimate imagery to the examples of problematic content. Such apps need the following mechanisms.
- Filtering to prevent objectionable content from being posted
- A mechanism to report offensive content, and timely responses
- The ability to block abusive users
- Published contact information so users can reach you
The announcement says it clarified that images generated with AI tools are also included in the content that must be prevented and removed. If your app includes generative AI features, such as creating internal documents or generating images for customers, check that all four of the above are in place.
Images shown on the store (2.3.14)
2.3.14 is the item on "creative assets" used in places such as headers on App Store product pages and in search results. Assets must relate to the app's content, functionality, or brand, follow the standard metadata rules, and be appropriate for all ages. It asks that the following not be included.
- Inappropriate content
- References to other apps intended to mislead
- Unverifiable product claims
- Specific pricing or discounted pricing information
If you commission store images from a web agency or designer, telling them at the request stage not to include unverifiable claims such as "No. 1 in the industry" or sale prices in the images can reduce rework.
Scope of verification
On October 26, 2026, we reviewed the Apple Developer news posts "Updated App Review Guidelines are now available" and "Strengthening App Review Guidelines against nonconsensual intimate imagery and bait-and-switch apps" (both October 16, 2026), and the text of the App Review Guidelines (last updated October 16, 2026), and on October 27 we rechecked the same materials and the Japanese version (last updated June 8, 2026) (document research). We have not checked actual app submissions for review, examples of review decisions, or the review results of apps that use feature flags.
For preparing for app review or reviewing the design of how features are switched on for different users, contact us through consultation on development, AI, and automation. How to approach outsourcing an app is also explained in Before outsourcing a business smartphone app.
