Apple Tightens App Review: Cracking Down on AI Nudification and Bait-and-Switch Apps

Apple has recently updated its App Review Guidelines, explicitly classifying non-consensual intimate imagery (including AI-generated "nudification" images) as content that must be proactively prevented and removed. At the same time, the new rules introduce harsher penalties for the long-standing problem of "bait-and-switch" apps that change functionality after approval.

Key Change: AI-Generated Intimate Imagery Explicitly Banned

Under the updated Section 1.2, content moderation requirements now explicitly cover non-consensual intimate imagery, with a specific callout for such imagery generated using AI tools. This means apps that offer to generate or host user content must establish proactive prevention and removal mechanisms, rather than relying solely on post-hoc reporting.

Apple emphasized in the original text that pornographic content has always been prohibited on the App Store, including apps that generate nude or pornographic images—such as "nudification" apps that create pornographic images of real people without their consent. For apps that host user-generated content, Apple requires them to filter objectionable content, provide reporting channels, and allow users to block abusive accounts.

The deterrence of the new rules lies in enforcement: if developers fail to implement adequate safeguards, or fail to correct violations after being notified, they risk violating the Developer Code of Conduct and may be removed from the App Store.

NCII (Non-Consensual Intimate Imagery) refers to intimate or sexualized imagery created and distributed without the subject's consent, long regarded as a form of digital sexual violence. Before the proliferation of generative AI, such content typically stemmed from covert recording, revenge leaks, or coercion; but "nudification" apps leveraging diffusion models can synthesize realistic nude images from a single ordinary photo, dramatically lowering the barrier to victimization—and victims often struggle to prove the images are fabricated. Legislation in multiple countries, including the U.S. Take It Down Act, is making "removal of NCII within a reasonable timeframe" a legal obligation for platforms. Apple's explicit inclusion of NCII in its review guidelines is a direct response to this regulatory trend and the reality of AI abuse, establishing "proactive prevention" rather than mere "post-hoc reporting" as the baseline for platform compliance.

Cracking Down on Bait-and-Switch: From Removal to Account Termination

Another key update comes from Section 2.5.19. This rule clarifies Apple's long-standing prohibition on "bait-and-switch" behavior—where an app conceals its true purpose during review and then changes its functionality after approval. For example, a version submitted for review that doesn't include certain features, only to secretly add them after going live.

The original text explicitly states that apps containing hidden or undocumented features are prohibited. Apps that misrepresent their purpose during review and only reveal harmful capabilities (such as "nudification" features) after approval are textbook examples of a "bait-and-switch" strategy.

For such behavior, Apple's penalties have been significantly escalated: the offending app will be removed from the App Store, and the developer will also be expelled from the Apple Developer Program. This effectively cuts off the violator's future distribution channels.

Bait-and-switch originates from the marketing world, referring to the practice of attracting users with a low-barrier or harmless promise, then substituting a different (usually more expensive or harmful) product once they've committed. In the app ecosystem, it specifically refers to the tactic of "hiding harmful features during review and dynamically activating them after launch," commonly implemented through server-side remote configuration switches (feature flags), returning different code based on region or review environment, and injecting content via hot updates after approval. What makes this behavior so dangerous is that static review can only see the submitted version—malicious features can lie dormant for extended periods. Apple's escalation of penalties from "app removal" to "developer account termination" is precisely aimed at raising the cost of repeat violations, making it no longer viable to re-list under a new shell.

Child Safety and Human Trafficking: From Removal to Distribution Blocking

Section 5 of the guidelines has also been updated. The App Store has always prohibited apps involving human trafficking or child exploitation (including child sexual abuse material). The original text states that once such content is discovered, Apple will remove it.

The update further clarifies that apps containing such content will not only be removed from the App Store but will also be blocked from spreading through alternative distribution channels. This closes the loophole where violators attempt to bypass the official store to continue distributing harmful content.

Alternative distribution channels refer to installation methods that bypass official app stores, primarily including Enterprise Certificates, developer certificate sideloading, TestFlight beta distribution, and web-based installation packages (such as enterprise-level or third-party marketplace distribution on iOS). Since the EU's Digital Markets Act (DMA) requires Apple to open up sideloading and third-party marketplaces, apps previously banned from the App Store could theoretically continue spreading through these channels. Apple's declaration that it will block content involving child exploitation or human trafficking across these channels as well effectively expands "store review" into "ecosystem-level prohibition," preventing violators from circumventing platform governance by switching distribution paths.

Enforcement: Over 150,000 Problematic Apps Blocked in a Year

Apple disclosed a set of enforcement data in its announcement: last year, Apple prevented over 150,000 problematic apps from reaching users and terminated over 193,000 developer accounts involved in fraud and abuse.

Behind these violations are often malicious actors, sometimes even coordinated fraud operations. They attempt to hide harmful content so it only activates after the app is approved. Apple says that as these tactics evolve, the company continues to improve its tools and resources to more quickly prevent and catch such behavior.

Looking at the overall approach of this update, Apple is shifting its review focus from "post-hoc response" to "proactive defense." For developers, this means compliance costs are rising; but for users, it may reduce the survival space in the store for malicious apps that use AI as a gimmick while actually violating privacy.

One-line Summary

Apple updates its review guidelines to explicitly ban AI-generated intimate imagery and crack down on bait-and-switch apps.

Paragraph Summary

Apple recently updated its App Review Guidelines, explicitly classifying non-consensual intimate imagery (especially AI "nudification" images) as content that must be proactively prevented and removed, requiring apps hosting user content to establish prevention mechanisms rather than relying solely on post-hoc reporting, with violators potentially removed from the App Store. For bait-and-switch behavior under Section 2.5.19, Apple has escalated penalties to app removal and developer expulsion from the Developer Program. Section 5 clarifies that apps involving child exploitation or human trafficking will not only be removed but also blocked from distribution through alternative channels. Apple also disclosed that last year it blocked over 150,000 problematic apps and terminated over 193,000 fraudulent developer accounts, with an overall shift from "post-hoc response" to "proactive defense."