If your app lets people create an account, both stores require that they can delete it. Apple's App Review Guidelines say it in one line: "If your app supports account creation, you must also offer account deletion within the app." Google Play's User Data policy says the same, and adds a requirement Apple does not have.
Neither rule is new. Google's deadline was December 7, 2023, with extensions to May 31, 2024. They still catch apps, because the delete button is the feature nobody puts in the first version and nobody asks for afterwards. This post covers what each store requires, where they differ, and a flow that passes both.
What counts as an account
Both stores read "account creation" widely. Apple's FAQ says an app that creates an account automatically, a guest account, still needs a delete option, and so does an app that sends people to a browser to sign up. Google says that if account creation is offered "in any part of the app experience," deletion is required, even if some features work without an account.
Google lists two exemptions: apps that are permanently private, and enterprise device management apps. It also says accounts that are created and operated offline are not app accounts. Apple's guidance lists no exemptions, though apps in highly regulated industries may add customer service steps to confirm a deletion.
What Apple requires
- Start it in the app. The option should be easy to find, typically in account settings. If deletion finishes on a website, the app must link straight to that page, not to your homepage.
- Delete, not deactivate. Offering only to temporarily deactivate or disable the account "is insufficient."
- No support detours. Apps outside highly regulated industries "should not require people to make a phone call, send an email, use a chat support flow, or go through other support flows."
- Confirmation is allowed. You may ask people to reauthenticate or enter a code to confirm, but apps that make deletion "unnecessarily difficult" will not pass review.
- It may take time. Manual deletion is acceptable if you tell people how long it will take and confirm when it is done.
- Their content goes too. That includes user-generated content shared with others, such as photos, posts, and reviews, unless the law requires you to keep something, in which case you say so.
- Everyone, everywhere. A deletion flow offered only in places where privacy laws demand it is not enough.
- Subscriptions and Sign in with Apple. If someone has an auto-renewable subscription, tell them billing continues through Apple and ask them to cancel it first. Apps using Sign in with Apple should revoke the user's tokens with Apple's REST API.
What Google adds
Google requires the in-app path too, and it allows that path to be a link to a web page instead of a full in-app flow. The addition is the second half: you must also provide a web link where people can request deletion without the app. Google's reasoning is that some users have already uninstalled it. The page must work without sending people back to reinstall, it must reference the app or developer name as it appears on the store listing, and the deletion request path must be easy to find on it.
That link goes into the Data deletion questions of the Data safety form in Play Console, which every developer has to complete, and it shows on your store listing. Google also says that when you delete an account you must delete the associated user data, and should ask any service providers that process it to do the same. Data you keep for security, fraud prevention, or regulatory reasons must be disclosed, for example in your privacy policy. Apps that do not comply may face enforcement, including removal from Google Play.
One flow for both stores
Our position: build deletion once, as a server-side job with two entry points, and treat it as a feature with its own test, not as a settings screen. The flow below satisfies both stores' published requirements:
The VENDORS line is the one most implementations skip. Deleting the row in your own database is the easy part. The same person also exists in your authentication provider, your analytics tool, your email service, and your file storage, and Google's guidance expects you to ask each of them to delete the data too.
The takeaway
Run this against your app before your next submission:
If any line fails, that is the work before the next release. Account deletion is the kind of requirement our custom software builds include from the first version. If you want us to check your app against this list, send us the store links.
// sources
// next step
We work this way on client projects too.
Tell us what you are making. We reply with a plan, a timeline, and a price.
