What do UGC apps need to pass review (1.2)?
Apple guideline 1.2 (Safety — User Generated Content) requires, and reviewers actively test for: a method to report objectionable content, the ability to block abusive users, published contact information, and filtering/moderation of objectionable material, plus terms that prohibit it. The report/block affordances must actually work in the build — reviewers flag dead report buttons. Google's UGC policy under its User-Generated Content rules mirrors this: in-app reporting, blocking, and an effective moderation system with stated enforcement. The rejection usually comes when the feature exists but is buried, non-functional, or when the app can surface pornographic or CSAM-adjacent content with no moderation story. Document your moderation (human, automated, or hybrid) in the review notes — one sentence there preempts the most common 1.2 bounce.
What are the kids category rules that kill apps?
Apple's Kids Category (guideline 1.3) and Google Play's Families policy are the strictest regimes in both stores. Core rules: no third-party analytics or advertising SDKs that collect or transmit personal data from children (with narrow exceptions for contextual, non-profiling ads and strictly limited analytics), no behavioral advertising, no external links or purchase opportunities reachable without a parental gate, and human review of ad content. Practically, this means the standard Firebase Analytics + AdMob stack is disqualifying in kids apps — the usual fix is ripping out third-party SDKs entirely or using self-hosted/first-party analytics. Also required: a privacy policy written for kids' data, COPPA/GDPR-K compliance, and on Play, the correct target-audience declaration plus enrollment in the Designed for Families program. Misdeclaring audience (marking 'not for children' while clearly child-directed) is a termination-grade violation on Play.
What do gambling, crypto, and finance apps need to show?
Real-money gambling (Apple 5.3): the app must be free on the store, must hold all licenses/permits for every territory where it is usable, must geo-restrict so unlicensed territories cannot play, and reviewers ask for license documentation. Google Play similarly permits real-money gambling only in listed countries with a completed application and proof of license. Crypto (Apple 3.1.5): wallets are fine; exchanges must be offered by licensed/established exchanges; apps may not mine crypto on-device; NFT-related unlocking of in-app features must go through IAP; wallet apps from unlicensed entities get bounced. Finance broadly: loan apps face aggressive personal-loan rules on Play (country-specific license declarations, APR caps, 60+ day terms) and Apple rejects unlicensed lending outright. In all three categories, upload documentation proactively in review notes — waiting for the rejection to prove licensure costs a week.
What extra requirements do UGC apps face under 1.2?
Apps with user-generated content must ship ALL of: a method for filtering objectionable content, an in-app mechanism to report it, the ability to block abusive users, published contact information, and — the element rejections cite most — a commitment to act on reports, commonly stated and tested as within 24 hours. Missing any one of the five is the standard 1.2 rejection. Practical shape: report button on every piece of UGC (not buried in a profile screen), block that actually removes the user's content from your view, a moderation queue someone genuinely checks daily, and moderation tooling to remove content — being able to only hide it client-side doesn't count. In review notes, name your moderation approach and response-time commitment explicitly; apps that make the reviewer hunt for the report button get rejected even when one exists.
I'm shipping a fintech/crypto app — what documentation do reviewers want?
Prepare before submitting, not after the rejection: proof of licensing/registration for every operating region (money transmitter, EMI, broker, or gambling licenses as applicable); for crypto specifically (Apple 3.1.5) — wallets are fine, but crypto EXCHANGE apps must be submitted by the exchange itself, under the exchange's own developer account, and only by established/licensed exchanges; no on-device mining is allowed; NFT features that unlock in-app functionality must go through IAP. Gambling apps (5.3) must be free on the store, licensed for every served territory, and geo-restricted. Upload the license documents proactively in the review notes attachment — the default reviewer action for an undocumented finance app is rejection, and proving licensure afterwards costs a week per round-trip.
What do gambling apps need beyond licenses to pass both stores?
Past the license paperwork, both platforms check four things. Age-gating: a real age gate at first launch (17+/18+ per market, date-of-birth entry — not a checkbox), enforced before any gambling screen renders. Responsible gambling: visible self-exclusion access, deposit/loss limit controls, links to problem-gambling resources (e.g. national helplines per market), and no 'guaranteed win' or risk-free framing anywhere. Geo-blocking that works: reviewers test from unlicensed-region accounts and expect hard blocks — IP-only gating with a working signup from a blocked territory fails; Apple's 5.3 and Play's RMG policy both require restriction to licensed territories by technical means, not disclaimers. Platform-specific: Apple requires the app to be FREE on the store for real-money gambling; Play requires enrollment in its RMG program per country. No simulated-gambling apps may target kids categories at all — 17+ rating minimum on Apple for any gambling mechanics.
The complete documentation pack reviewers want from fintech and crypto apps
Assemble before submission — the default response to an undocumented finance app is rejection: (1) regulatory licenses/registrations for every operating region (money-transmitter, EMI, broker-dealer, VASP registrations as applicable); (2) KYC/AML policy summary and the name of your compliance contact or officer; (3) terms of service and privacy policy covering financial data specifically; (4) for lending: APR disclosure methodology and, on Play, the country-specific personal-loan declarations; (5) for crypto: proof the exchange/custody entity is licensed, and that the app is submitted under THAT entity's developer account; (6) custody/insurance arrangements where client funds are held (custodian name, insurance coverage summary); (7) category-specific: gambling licenses for anything with wagering mechanics. Upload as review-notes attachments, not on request — every round-trip costs a week, and 'available upon request' reads as 'doesn't exist'.
UGC apps: CSAM detection, age-gating, and what reviewers test under 1.2
Beyond the five core 1.2 elements (filtering, reporting, blocking, contact, 24-hour action), reviewers and both platforms expect: CSAM handling — automated detection for image/video uploads (PhotoDNA-class hashing services or a vendor like Thorn; Apple requires reporting to NCMEC for US services and has rejected apps with no detection story), and a written policy you can produce; age-gating — UGC apps with mature content need 17+ ratings and age gates, and UGC accessible to minors needs stricter default filtering plus no adult-content discovery paths; prohibited-content rules published in-app (the acceptable-use policy must exist inside the app, not just on your website). What reviewers actually test: they create accounts, post text content, look for the report button on content AND on user profiles, attempt to find unmoderated public feeds, and check whether blocked users' content truly disappears. The standard rejection cites 'insufficient moderation' — the fix is demonstrating the queue exists and someone answers it.