Apple: Account deletion within apps required starting January 31

[kevincador]

Hi,

I'm a bit worried about this https://developer.apple.com/news/?id=mdkbobfo and I'm not sure if it has already been discussed.

Do you have any plan to open a public API endpoint to do that? It may not be required if Apple is okay with a redirection to trakt.tv website but I'm not sure about that and it's always a big risk knowing Apple's review process for apps.

Cheers,

Kevin

[tysonkerridge]

My initial thoughts on this requirement are that so long as you offer a way to link to say https://trakt.tv/settings, which includes the Delete Account button, that should be enough, even it you were to label the action as "Delete Account" or "Manage Trakt Account", etc. Especially considering "account creation" isn't actually done natively within the app, and instead within a safari session.

It's also possible that for third-party apps, in general, there may be an exception to the deletion guideline similar to Sign In with Apple guideline in 4.8:

Sign in with Apple is not required if:
• { other exceptions }
• Your app is a client for a specific third-party service and users are required to sign in to their mail, social media, or other third-party account directly to access their content.

Either way, time will tell...

[kevincador]

Hi,

I found a thread discussing that on Apple's developers forum: https://developer.apple.com/forums/thread/681790

Even if I agree with you with the creation being handled via oauth, I'm still worried about it and worried a link to the settings may get us rejected because, for me, the first popup after asking to delete my account says I need to unsubscribe from vip first 😬.

The "good" news is the deadline for this has been punched to June 30, 2022 as per Apple's latest email.

Right now I'm not going to add anything in app and cross my fingers until then.

Cheers,

Kevin

[tysonkerridge]

The fact that there's still no official response in the thread I'd say it's all assumptions at this point. Also unless I missed something, I don't think it really mentions anything about third party cases.

I also think, for third party Trakt apps, that the fact that "account creation" doesn't necessarily happen within the app (and rather is within a safari flow, depending on the device) means the deletion can be the same, if not non existent because it's not in your control at that point.

I assume right now that if a user contacts you asking to delete their account, that you're already prompting them toward their Trakt settings page and/or Trakt support website/emails, which is the best you can do.

I did see that it was delayed also which might mean they haven't fully decided how to enforce it.

[kevincador]

Hi @tysonkerridge @rectifyer,

Had my first rejection because of this 😝

Bug Fix Submissions

The issues we've identified below are eligible to be resolved on your next update. If this submission includes bug fixes and you'd like to have it approved at this time, reply to this message and let us know. You do not need to resubmit your app for us to proceed.

Alternatively, if you'd like to resolve these issues now, please review the details, make the appropriate changes, and resubmit.

Guideline 5.1.1(v) - Data Collection and Storage

We noticed that your app supports account creation but does not appear to include an option to initiate account deletion.

Apps that support account creation must also offer account deletion to give App Store users more control of the data they've shared while using your app.

Next Steps

If your app already supports account deletion, reply to this message and let us know how to locate this feature. If your app does not support account deletion, revise your app to include an option to initiate account deletion.

If you are unable to offer account deletion or need to provide additional customer service flows to facilitate and confirm account deletion, either because your app operates in a highly-regulated industry or for some other reason, reply to this message in App Store Connect and provide additional information or documentation. If you have questions regarding your legal obligations, check with your legal counsel.

Keep these requirements in mind when updating your app to support account deletion:

• Only offering to temporarily deactivate or disable an account is insufficient.

• If users need to visit a website to finish deleting their account, include a link directly to the page on your website where they can complete the process.

• You may include confirmation steps to prevent users from accidentally deleting their account. However, only apps in highly-regulated industries may require users to use customer service resources, such as making a phone call or sending an email, to complete account deletion.

Resources

• Review frequently asked questions and learn more about the account deletion requirements.

• Apps that offer Sign in with Apple should use the Sign in with Apple REST API to revoke user tokens.

I'm going to try to go around it and say the account creation is not really done via the app but via the web view but I'm not sure they are going to go with it...

I'll keep you posted!

Cheers,

Kevin

[tysonkerridge]

For what it's worth, we also were questioned about deletion and added an explicit "Delete Account" option in settings that opens https://trakt.tv/settings which seemed to get approved with no issues even though the user may have to log in first in order to access the delete flow. That was based on the following from the resources included in the rejection (https://developer.apple.com/support/offering-account-deletion-in-your-app):

• Make the account deletion option easy to find in your app. Typically, it’s included in the app’s account settings.
• If people need to visit a website to finish deleting their account, include a link directly to the page on your website where they can complete the process.

[javikr]

Our app have just being rejected by Apple because of this:

We noticed that your app supports account creation but does not include an option to initiate account deletion that meets all the requirements. Specifically:

• Your app redirects the user to a website to complete account deletion, but does not link directly to the appropriate page to complete the process.

The process for initiating account deletion must provide a consistent, transparent experience for App Store users.

Just let you know: our app has an option with the text "Delete Account" which opens the in-app browser with the Trakt settings url (https://trakt.tv/settings). We are not sure how can now proceed with the App Review Team...

Do you know if there are any plans to develop a direct link to a "delete account" page?

[tysonkerridge]

I would suggest to them that you use a third party account that you have no control over the deletion flow and otherwise have included a delete button that takes the user to the page where they can access the delete account confirmation. Perhaps include screenshots for the reviewer.

[javikr]

Thank you! I will try it :)

[javikr]

Just to inform that our app was approved after being rejected by Apple. In order to help other devs in the same situation, I have answered the app reviewer the following:

We are using a third party account so we have no control over the deletion flow, therefore we have included a delete button that takes the user to the page where they can access the delete account confirmation based on the following support page (https://developer.apple.com/support/offering-account-deletion-in-your-app).

Thank you again for your support ;)

[kevincador]

Hi again,

I've got rejected again (not the first time since the first rejection) for this and similar login/account settings issues.

There are 4 rejection reasons (1 on the Mac, 3 on iOS/iPadOS):

1. on the Mac, they really don't like the fact that the login happens in a web view. I've been able to work around this with communications (always long and unnecessary) with Apple's review team but now they are requiring me to implement "Sign in with Apple" from the app directly. I don't even know if that's possible + I really don't want to do it. A simple solution would be to remove Sign in with Apple from the login screen for third party apps (I guess) or should I go through a "device login" flow? I don't know, @tysonkerridge you help on this one would be greatly appreciated!
2. on iOS, they are bothering me because the "delete account" is not available in the app directly. I may add some wording in my app to tell users they can delete their account via the "All Trakt Settings" button. But I was thinking about a specific web page your side that could be opened from third party apps to kick start the account deletion process. Would that be possible?
3. they are also complaining because the Browse button (to change my avatar) in the Trakt settings page is unresponsive on iOS devices. It is true, even if not relevant in an app review but whatever, I stopped talking to them for this kind of stuff 😒
4. the login and settings page are filled with cookie popups (also because I'm always opening them in private mode), they are complaining there because I say I don't track my users (which is true) but they see the cookie popups and are asking that I add some disclaimer saying I track my users. Would it be possible to remove the cookie banners for login and settings management when it comes from third party apps? Also, if we could pass a token or something that would make the settings page understand this is a logged in user, it would also solve a lot of friction from their side (I guess).

Anyway, no fun Apple review team member is... no fun.

Cheers,

Kevin

[tysonkerridge]

If you haven't already, I would direct them to their Review Guidelines 4.8 'Login Services' which states apps that are third party clients don't need to offer any alternate things, and you have no control over the log in flow.

[1] Regarding the Mac issue, I'm unsure how your log in flow is working (via safari) but you could look into if you're using the same thing as Ice Cubes Mastodon App which seems to use WebAuthenticationSession and otherwise suggest to them that there's no alternative for log in on Mac for many third party services that use OAuth. I noticed that Ice Cubes seems to bring up a pop up on Mac before using a web view whereas yours doesn't seem to show this. Attached image at the end.

For all the rest, other than if some things can be improved to reduce the cookie popups, it seems like it goes hand in hand with the fact that all of these are not under your control - the API doesn't provide these things - so the alternative is to take them out and then users have no way to discover how to do it at all. Refer them to Review Guidelines 5.1.1 (v) 'Account Sign-In' which shows these details they're probably referring to but that don't apply to you being a third party client.

[2] For 'delete account' you're not the owner of the account (and the API doesn't offer this) so you've done all you can. You don't explicitly offer account creation (it happens via the third party) so it shouldn't be a requirement for you to even offer deletion, as mentioned above with 5.1.1 (v). Maybe at best these settings should be in a section that has some information saying "these are convenience access points to your Trakt account management and not in Rippple's control."

[3] For 'browse' yeah it seems like you have to long press on that button for some reason. There's no way this should be even brought up in your app review 🫠.

[4] Again I'm not sure what they can require you to do here - if you haven't already I would say you'd have to have them tell you directly what they'd like you to do given you have zero control over this. I think the third party client thing is something that hasn't been completely fleshed out by Apple when it comes to 'tracking users'. Like even though you yourself don't collect data, as soon as a user logs in they're then under Trakt's privacy policy and 'tracking' handling for anything user related so it becomes a grey area I suppose.

[kevincador]

Hey,

Thanks a lot for your feedback, I'll keep the communication open with them and pass your inputs, thanks!

[1] I'm using ASWebAuthenticationSession (the UIKit version of what Ice Cubes uses) on all targets (via Catalyst on the Mac). It's just that on iOS/iPadOS, the system opens a web view modally and it seems like it's an app thing. On the Mac, it opens Safari and I guess that what bothers them.
I'll try with the guidelines you provided to change their mind.
[2] Exactly what I was thinking. Also to be safe for future submissions.
[3] I'll tell them to long press and that you guys are aware of it.
[4] Exactly! Thanks!!

I'll let you know what happens next and how I work around those issues, thanks again for your feedback!

Cheers,

Kevin

[kevincador]

🤞

Hello Kevin,

Thank you for providing this information.

We will continue the review, and we will notify you if there are any further issues.

Best regards,

App Review

[kevincador]

And the build was accepted (iOS).
Still waiting for the macOS version 😬