Apple’s new App Store rules crack down on AI nudification and ‘bait-and-switch’ apps

Apple added stronger rules for apps involving user-generated content, including nonconsensual intimate imagery and anonymous bullying. Developers must use appropriate safeguards and address reported violations. Otherwise, Apple may consider them in violation of the Developer Code of Conduct.

Apple also created Section 2.5.19 to target bait-and-switch apps. It bans hidden, dormant, or undocumented features and specifically mentions code obfuscation. An app must clearly show its functionality to both users and App Review. This directly targets apps that appear harmless during review but later reveal nudification or gambling functions.

The consequences are serious. Apple can remove an app from the App Store and terminate the developer account when hidden functionality is found. The changes follow investigations into AI nudify apps, disguised gambling apps, and harmful images generated through Vector. They make concealment itself an explicit reason for removal.

An AI “nudify” app is a tool that digitally alters an image to make a clothed person appear nude or sexually exposed. The result is generated content, not necessarily a real photograph of the person. The key harm is that the person’s image can be sexualized without permission.

That lack of consent explains the term “nonconsensual intimate imagery.” Someone can upload or use another person’s photo, then create an intimate-looking image without that person approving it. The article identifies these apps as a particular challenge for user-generated-content platforms and app reviewers.

The problem reached Apple’s App Store. The Tech Transparency Project identified dozens of AI-powered nudify apps in January. Its April follow-up said search suggestions and advertisements were directing users to such apps. In July, San Francisco officials ordered Apple to remove eight apps capable of generating nonconsensual intimate imagery.

The article describes a broad pattern rather than one isolated failure. The Tech Transparency Project found dozens of AI-powered nudify apps on the App Store. A later investigation found Apple’s search suggestions and advertisements also directed users toward them. These findings showed that discovery tools could amplify access to harmful apps.

A separate 9to5Mac investigation found dozens of apps disguising gambling platforms as games and utilities. Many were available to children. They behaved normally outside Brazil but revealed betting platforms when opened from Brazilian IP addresses, showing how location-based behavior could evade review.

The Vector controversy added another major example. Elon Musk’s chatbot was used to generate nonconsensual sexualized images of women and minors. Lawmakers and advocacy groups urged Apple to remove X and Vector. Apple later said it had privately warned Vector that Vector could be removed unless the issue was addressed.

A bait-and-switch app presents one purpose to Apple’s reviewers but delivers another to users later. During review, it may behave like a simple game, utility, or ordinary image tool. After approval, hidden code or conditions can activate a harmful capability that was not visible during testing.

The article gives a location-based example. Dozens of apps looked like games and utilities outside Brazil, but revealed hidden betting platforms when opened from Brazilian IP addresses. This use of regional behavior allowed the apps to appear compliant in some review conditions while exposing users elsewhere to gambling services.

The same basic strategy can conceal nudification. An app might show ordinary image editing during review, then activate a nudification feature after approval. Apple’s new Section 2.5.19 explicitly bans hidden or undocumented functions and says code obfuscation can lead to removal and developer-account termination.

Apple’s updated rules create two connected sets of consequences. If an app hides dormant, undocumented, or obfuscated features, Apple says it can be removed from the App Store. The developer account can also be terminated. This raises the cost of disguising an app during review.

The user-generated-content rule adds a separate responsibility. Developers must implement appropriate safeguards for problems such as nonconsensual intimate imagery and anonymous bullying. If Apple gives notice of violations and the developer does not remediate them, the developer may be considered in violation of the Developer Code of Conduct.

These rules matter because the article describes apps that concealed harmful capabilities or exposed people to harmful content. Apple’s wording now makes both concealment and failure to respond explicit risks. The result is a stronger enforcement framework, though the article does not describe how every case will be investigated.

Apple strengthened Section 5, its Legal section, for apps that facilitate human trafficking or exploit children. The updated language says these apps will be removed from the App Store and blocked from alternative distribution. The rule therefore covers more than Apple’s main storefront.

Removal stops the app’s App Store listing. Blocking alternative distribution closes another route for distributing the same prohibited software through Apple’s ecosystem. This is different from rules aimed only at review concealment, because the stated subject is the app’s role in trafficking or child exploitation.

The article does not describe Apple’s technical process for blocking alternative distribution. It does state the outcome clearly: both forms of distribution are covered. That makes the policy harder to evade through a change in distribution channel. The update places these activities among the most serious legal violations in Apple’s guidelines.

App-store review generally examines a submitted app, its declared purpose, and its behavior under test conditions. Reviewers may use automated checks and human inspection. The goal is to confirm that the software follows platform rules before users download it. The article focuses on Apple’s App Review process but does not detail its exact testing methods.

Code obfuscation changes program code so its logic is harder to read or recognize. A developer could use it to conceal an undocumented feature from review. Location checks or other conditions could also make a feature appear only for certain users. The article specifically links obfuscation with attempts to hide functionality.

Apple’s new Section 2.5.19 makes this tactic an explicit violation. It says hidden, dormant, or undocumented features can lead to removal and account termination. The rule responds to apps that appeared harmless during review but later revealed gambling or nudification capabilities.