What do App Review rules require for digital goods and subscriptions, and how do external purchase links and regional rules change that?

28.6.1 · L3 · Interview

Mental model. The store is a mall with house rules: some rules are permanent (the shop fits the lease), others are renegotiated by courts and regulators, so you keep them in the lease file, not in the shop sign.

What I am confident about. Under the App Store Review Guidelines, digital content, features and subscriptions unlocked inside an app generally must use In-App Purchase (guideline 3.1.1); subscriptions must provide ongoing value, be clear about price, renewal and trial terms before purchase (3.1.2), and an app must offer a way to restore purchases. Exceptions have long existed for physical goods and real-world services, person-to-person services, and "reader" style apps with limited linking, and you cannot gate IAP behind unrelated actions, use your own unlock keys for digital goods, or mislead about what is free. Apple takes a commission on IAP (standard and small-business tiers) and requires a clear subscription disclosure. Review rejections cluster around missing restore, unclear price or trial text, unfinished products, and links or wording that steer users away from IAP where that is not permitted.

What changes by region, and what to verify. The landscape moved repeatedly between 2024 and 2026: the EU's Digital Markets Act enabled alternative distribution and payment options with their own terms and entitlements; Japan and other jurisdictions introduced their own regimes; and in the United States court rulings changed what link-out buttons are allowed. I cannot reproduce the current text reliably from memory, so for a real product read the current guidelines and the StoreKit External Purchase documentation (there are entitlements to request, an ExternalPurchase API with a disclosure sheet, and reporting obligations in regions that require them). Design so this is configuration: a per-storefront policy table (which regions may show an external link, which disclosure, which commission reporting), checked against Storefront.current with a server-side switch, and with the IAP path always working as the default. Nothing in this answer was run; it needs App Store Connect and current policy text.

Common traps

  • Assuming a US ruling applies everywhere. Rules are per storefront and change; gate by region and verify.
  • Hard-coding a link-out in the binary. Review rules can change after release; keep it behind a remote switch.

They might follow up with

  • Do reader apps need IAP? They get a limited exemption with strict conditions; check the current wording.
  • Do taxes matter? Apple collects and remits taxes for IAP in most regions; external payments make you responsible.

Related questions

  • 28.5.1 How do you design a paywall that is clear, localised and legal, and how do you run experiments on it?
  • 28.5.2 How do you test purchases: StoreKit configuration files, sandbox accounts and TestFlight, and what can each…
  • 28.6.2 Design the billing and entitlement platform for an app with iOS, Android and web subscriptions and a backend…
  • 25.3.2 How does App Review work, what causes common rejections, and what are export compliance, the privacy labels…
  • 25.4.1 How do you design feature flags and remote config for a mobile app: flag kinds, defaults, stable percentage…

Design the billing and entitlement platform for an app with iOS… →