Ing. Calogero Bono
On October 16, 2026, Apple published an update to the App Review Guidelines, the rules every app must follow to enter the App Store. The changes concern non-consensual intimate images, including those generated with AI, and apps that change features after approval. At the start of November, an investigation by Wired showed why the issue is concrete, with over 400 apps and domains linked to a network of abusive deepfakes. For app developers, the rules are now stricter.
A few terms before we get into the facts. Nudification or nudify refers to apps that create sexually explicit images of real people without their consent. Deepfake is AI-generated content that places someone's face into scenes that never happened. Bait-and-switch is the tactic of showing Apple a harmless app and activating harmful functions after approval. App Review is the check Apple performs on every app before publication. CSAM stands for child sexual abuse material.
What changes in the App Review Guidelines?
According to Apple's official announcement, the changes touch three points. The first is rule 1.2 on content moderation, which now explicitly cites non-consensual intimate images, including those generated with AI tools. Apps must prevent and proactively remove them.
Those who do not adopt adequate safeguards, or do not remedy the problem after a report, risk violating the Developer Code of Conduct and being removed from the store.
What does the new rule 2.5.19 say?
Rule 2.5.19 clarifies an existing prohibition. An app may not present one thing during review and change after approval, for example by adding functions that were not in the version submitted to Apple.
The consequences are removal of the app and exclusion from the Apple Developer Program. It is not only the app that is lost, but the account of whoever publishes it.
For those who have already published on multiple stores, it may be useful to review how approval works on Google Play, where the checks follow different logic.
What does Section 5 say about child abuse?
Section 5 has always prohibited apps that facilitate human trafficking or the exploitation of minors, including child sexual abuse material. Apple has updated the text to specify that these apps will be removed from the App Store and blocked from alternative distribution as well.
This is a significant step, because it extends the ban beyond the official store. Apple also states that last year it prevented over 150,000 apps with security problems from reaching users and shut down over 193,000 developer accounts for fraud and abuse.
What did Wired's investigation uncover?
The Wired investigation, picked up by 9to5Mac, found a network of over 400 domains and apps. They present themselves as everyday services, for example an app that dresses pets' photos in human clothing, such as Viefur.
A server-side check decides whether to show the harmless content or a web interface that generates explicit sexual deepfakes. A possible trigger is downloading the app after clicking an ad on Meta. The researchers cited by Wired describe an organized, commercial operation. Apple removed 19 apps after the report.
Spokesperson Adam Dema explained that the apps complied with the rules at review and that the developers later changed the website from which the app draws its content.
Limits to know
Several points remain unverified. Wired attributes the network to Chinese developers and a Hong Kong entity, but the contacts did not respond. It is unclear whether the new rules would have stopped these apps, which according to Apple were compliant during review. There is no public list of the criteria that trigger the hidden part. Google did not respond to Wired, and data on the effectiveness of the controls is self-reported by the companies.
What changes for those working in digital
If you develop apps that display user-uploaded or AI-generated content, you need filters, reporting, and account blocking, and now also a strategy against non-consensual intimate images. If your app loads content from a website or server, carefully document what it can display. A post-approval change that alters the app's purpose can cost you your account. For companies commissioning an app, it is worth clarifying in the contract who is responsible for the content. A good starting point is iOS and Android app development with clear rules from the outset.
Our take
The rules are right, but the Wired case shows their limit. A review photographs the app at a precise moment, while the content can arrive later from a server. Apple shifts responsibility onto developers and advertising platforms, and this is partly true. Still, the fact remains that apps active for about a year moved across multiple stores. Continuous checks after publication are needed, not just before. We will see whether rule 2.5.19 is enforced with this severity even against developers with long-standing accounts.
Frequently asked questions
When did Apple publish the new rules?
On October 16, 2026. The update covers rule 1.2, rule 2.5.19 and Section 5 of the App Review Guidelines.
Are AI-generated images covered?
Yes. Rule 1.2 explicitly cites non-consensual intimate images generated with AI tools, which apps must prevent and remove.
What risks does a developer face for changing an app after approval?
Removal of the app and exclusion from the Apple Developer Program. This applies to added functions that were not in the version submitted for review.
How many apps did Apple remove after Wired's investigation?
Nineteen, including the app Viefur, after Wired shared the linked domains. Wired, however, speaks of a network of over 400 apps and domains.
Is Google involved too?
Yes. According to the sources, the same apps were on Google Play, where Google had removed most of them before being contacted by Wired.
What to watch in the coming months on apps with hidden features
The real test will be how the rules are enforced, not the text. It is worth watching how Apple, Google and Meta move.
- Check whether Apple publishes new data on removals and closed accounts for bait-and-switch.
- Verify whether Google Play updates its policies in a similar way, including for the European market.
- Reread the guidelines with each new app version and note every function that can change on the server side.
