Do iPhone Apps Need Consent to Send Data to AI?

Yes. Since Apple's App Review Guidelines update of November 13, 2025, guideline 5.1.2(i) says you must clearly disclose where personal data will be shared with third parties, "including with third-party AI", and get explicit permission before doing so. If your app sends what a user types, says or photographs to a hosted model, that needs a clear explanation and a real yes from the user before the first request.

Several of the apps I have built send text, voice or images to a model that runs on someone else's servers. That is the normal way to build an AI product right now. What changed in late 2025 is that Apple put it in writing, and an App Store reviewer can now point at a specific line when a consent screen is missing.

What the guideline says

Apple's announcement of the update lists the change in one sentence: it "clarifies that you must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so."

The full rule in the App Review Guidelines sits inside 5.1.2, Data Use and Sharing. Around that sentence it repeats the older requirements: you may not use, transmit or share someone's personal data without their permission, you must tell people how and where the data will be used, and apps that share data without consent can be removed from sale.

The word "clarifies" matters. Sharing personal data with any third party already needed consent. Naming AI removes the argument that sending a chat message to a model provider counts as processing rather than sharing. Europe is pushing on the same point from another side, with the AI Act's rule that a chatbot has to say it is AI.

What counts as sharing with AI

As I read it, the trigger is personal data leaving the device for a model run by another company. Prompts that contain what the user wrote, voice recordings, photos and camera frames, documents, contacts and health data all qualify the moment you send them to an outside API, even if the provider promises not to train on them.

A model that runs entirely on the phone is a different case, because nothing is shared. So is a model you host yourself, although then the regular privacy disclosure applies. When an app mixes both, the consent should describe the part that leaves the device.

Apple has not published a list of edge cases, so where you are unsure, ask. It costs one screen.

What a good consent screen says

The guideline asks for two things: a clear disclosure of where the data goes, and explicit permission. In interface terms, that means a screen the user sees before the first request, with a button that means yes.

• Say what is sent, in plain words. "Your messages and any photos you add."
• Say where it goes. Name the company that runs the model.
• Say why. "To write the reply" is enough.
• Link to your privacy policy, and keep the policy consistent with the screen.
• Give a real choice. A decline button that leaves the rest of the app usable, or at least explains what will not work.

Ask at the moment it makes sense. A camera feature can ask when the user first opens the camera, not during onboarding when nobody knows what the feature is yet. And keep a way to change the answer later in settings, because a yes given once is not a yes forever.

What does not work is a sentence in the terms of service, a checkbox that is already ticked, or a line at the bottom of the onboarding that says "By continuing you agree". None of those is explicit permission in the ordinary meaning of the words.

Keep the privacy label in sync

A consent screen does not help much if the App Store page says something else. Apple's page on App Privacy Details asks you to describe your privacy practices, including those of third party partners whose code you integrate, and defines collecting data as transmitting it off the device in a way that you or your partners can access for longer than it takes to answer the request in real time.

So read your model provider's data retention terms before you fill in the label. If prompts are kept for a period, for abuse monitoring for example, your label and your consent screen should both reflect that. A reviewer who sees a model on the screen and "Data Not Collected" on the product page will ask.

Why this is good design anyway

I would build this screen even without the rule. People are more careful with AI than with most features, and the ones who say yes after a clear explanation use the feature with more trust than the ones who were never asked.

So I keep it on the same list as the other details in nine launch details that keep an app out of legal trouble, and check it before every submission rather than after a rejection.