App Store and Google Play Listing: 2026 Requirements

Publishing an app on the App Store and Google Play is more than uploading a build. The platforms check who you are as a developer, how the app collects data, how it makes money and whether it changes after approval. In 2026 Apple updated its review guidelines three times and its developer agreement four times, and from 30 September Google began tying app installation to developer verification. We go through what both platforms require according to their own documents, where the risks for a company lie and what to put in contracts with contractors.

Checked on 22 October 2026. Rules and sources are current as of this date.

Account
Android verification
Review
Data
Payments
Special categories
Risks
Comparison
What to do
FAQ

Who you are to the platform

The first thing both platforms check is the identity of the developer. The account type determines the seller name that users see, the app categories you can publish and how your first release goes.

Apple, organisation

An organisation must be a legal entity able to enter into contracts with Apple. Apple does not accept DBAs, fictitious or trade names and branches, and the organisation’s name is shown as the seller of the app. An organisation, except a government one, needs a D-U-N-S number, which Apple uses to verify identity, legal entity status and address. The work email must be on the organisation’s domain.

Google, two account types

Google offers Personal and Organization accounts. These must register as an Organization: financial products and services (banking, loans, stock trading, investment funds, crypto software wallets and exchanges), health apps, apps using VpnService and government apps. An organisation needs a D-U-N-S number and its account details must match its Dun & Bradstreet profile.

New Google personal accounts

Personal accounts created after 13 November 2023 must run a closed test with at least 12 testers who stay opted in continuously for at least 14 days. Only then is production access unlocked, and the application is usually reviewed within seven days.

Account transfers

Google allows an account to be transferred only through its official process, for example on a reorganisation or acquisition, and prohibits buying, leasing and selling accounts through third-party marketplaces.

Our takeaway

The developer account is best registered to the company that owns the product, not to a freelancer or studio. That keeps the seller name in the store, the verification data and the right to manage the app with the owner.

Android developer verification

Google has introduced developer verification and registration of every app with a verified developer. The tools have been open to all developers since 30 March 2026. From 30 September 2026 in Brazil, Indonesia, Singapore and Thailand, unregistered apps cannot be installed and updated normally on certified devices, and in 2027 the requirement becomes global. Apps from Google Play are registered automatically, and according to Google this has already happened for 99% of them. Distribution outside Play requires an account in the Android Developer Console, and students and hobbyists can use a free limited distribution account with no ID, for up to 20 devices.

26 August 2026

Child policies, child safety and 18+ content policies apply to apps with anonymous and random chat.

30 September 2026

Deadline to register apps in Play Console. Check which apps were not registered automatically.

27 January 2027

Broad access to contacts is restricted, requirements for location, SMS and call log change, and geofencing stops being an approved foreground service use case.

What review checks

Review on both platforms checks not only whether the app works but how honestly you described it.

Apple, completeness and description

Rule 2.1 requires a final version with all metadata, working links and a demo account if there is a login. Under rule 2.3.1 all new features must be described in Notes for Review, and misleading marketing is grounds for removal of the app and termination of the account.

Apple, hidden features

New rule 2.5.19 of 16 October 2026 prohibits hidden, dormant and undocumented features, including those concealed by obfuscation. An app that misrepresents itself during review and gains new functionality after approval is removed from the App Store and from the developer programme.

Google, before submission

The Play Console requirements call for accurate metadata, a privacy policy and the Data safety form, a working demo account and all materials needed for review, plus registration of package names.

Our takeaway

Everything the app can do, including features switched on remotely, should be described to the reviewer in advance. A contract with a developer should prohibit hidden features and circumvention of review.

Data and privacy

Data rules have grown from a privacy policy into a mandatory part of the listing.

Apple, the policy

Under rule 5.1.1 every app must have a privacy policy, linked in App Store Connect and inside the app. It must say what data is collected, how and why, confirm equal protection by third parties (analytics, advertising, SDKs) and explain retention, withdrawal of consent and deletion.

Account deletion

If an app lets people create an account, it must let them delete it inside the app (Apple, 5.1.1(v)). Google requires the same and also a web link to request deletion of the account and data, and the answers in the Data safety form are visible on the app’s listing.

Payments and subscriptions

Apple’s rule 3.1.1 requires in-app purchase to unlock features and content and does not allow your own unlock mechanisms, including licence keys, QR codes, cryptocurrencies and crypto wallets. In the EU the terms are changing.

EU from 1 October 2026

On 18 August Apple announced a single set of business terms for all developers in the EU. Commission rates change, alternative payment options are allowed alongside in-app purchase, and the Core Technology Fee is replaced by a Core Technology Commission of 5% on digital transactions in apps distributed outside the App Store.

Apple agreement of 13 October

Security requirements for using Apple software and services were updated (section 3.2), and terms were added for the Live Assistance API (application programming interface) and the App Replacement Entitlement. Apple reports legally required information to tax authorities, and customer tax information shared with developers may be used only for purposes mandated by law.

Need help with this topic?

We will review your situation and propose a solution for your project.

Special categories

For some kinds of apps, platform rules add to industry regulation.

User content and AI

After the 16 October 2026 update, Apple’s rule 1.2 expressly includes nonconsensual intimate imagery, including AI-generated imagery, in mandatory moderation. Apps with user content and AI generation need filtering, reporting with timely responses, blocking of users and published contact details. If safeguards are not implemented or violations are not remedied after notice, the developer risks breaching the Developer Code of Conduct and losing the app.

Betting and gambling

Rule 5.3.4 requires licences and permissions in each jurisdiction of use, geo-restriction, and the app must be free on the App Store. Rule 5.3.3 prohibits buying credit for real money gaming through in-app purchase. For Brazil, on 8 May 2026 Apple said a licence from the Secretariat of Prizes and Bets was required, but the market was later changed by Provisional Measure No. 1,394, which we covered separately.

Finance, health, VPN

Google requires such apps to register as an organisation. At Apple, VPN (virtual private network) apps under rule 5.4 may be published only by an organisation.

What can go wrong and how to protect yourself

Both platforms keep broad rights, and their terms are not negotiable.

Google, removal and blocking

Under Google’s Developer Distribution Agreement (version effective 15 September 2025) Google may reject or block a product and remove it if it violates the law, the agreement or the policies or creates a risk of liability or harm for Google. Google may also limit the visibility of a product and suspend payouts to the developer (clause 8.3).

Google, termination

The agreement may be terminated at any time on the grounds in clause 10.3 or on 30 days’ notice. Google’s liability for indirect damage is excluded (section 13), and the developer indemnifies Google and its partners against third-party claims (section 14).

Apple, expulsion from the programme

For dishonest conduct, rules 2.3.1(b) and 2.5.19 provide for removal of the app and expulsion from the developer programme. Apple stated that last year it prevented more than 150,000 apps with safety issues from reaching customers and terminated more than 193,000 developer accounts for fraud and abuse.

Three contract protections

First, the accounts and signing keys belong to the company and stay with it. Second, the contractor must follow platform rules, add no hidden features and report review claims. Third, the user terms and privacy policy must match what you filled in on the platform forms, otherwise a mismatch becomes a ground for rejection in itself.

Apple and Google side by side

A summary of what both platforms state directly in their own documents.

Question	Apple	Google
Organisation	A legal entity with a D-U-N-S number, no branches or DBAs	D-U-N-S and a match with the Dun & Bradstreet profile, mandatory for finance, health, VPN and government apps
New personal account	No closed test	Closed test, 12 testers, 14 days in a row
Developer verification	Through the programme and app review	App registration, from 30.09.2026 in four countries, global in 2027
User account deletion	Inside the app (5.1.1(v))	Inside the app and a web link
Hidden features	Rule 2.5.19, removal and expulsion from the programme	Blocking or removal under clause 8.3 of the agreement
Cryptocurrencies	Not allowed as your own unlock mechanism (3.1.1)	Crypto wallet and exchange apps register as an organisation

What to do now

Check who owns the accounts
Find out whom the Apple and Google accounts are registered to and who holds the signing keys.
Start here
Register your apps
In Play Console, check the registration status of each app before new releases.
Reconcile the data
The privacy policy, the Data safety form and the actual data collection, including SDKs, must match.
Check account deletion
The app needs an in-app account deletion path and, for Google, a web link too.
Describe every feature
Tell the reviewer about everything the app can do and remove anything undocumented.
Update your contracts
Add platform rules, a ban on hidden features and account transfer terms to contractor agreements.

Requirements are growing fast

Both platforms change their rules several times a year. Assign someone in the company to follow them and check releases before submission.

A platform trusts a developer exactly as far as review can see the whole app.The LegalBit team

Frequently asked questions

Can an app be published under a contractor’s account?

Technically yes, but the contractor would be the seller in the store and the account holder, and Google permits account transfer only through its official process. We advise registering the account to the company that owns the product.

What happens if Apple finds a hidden feature?

Under rule 2.5.19 the app is removed from the App Store and the developer may be expelled from the developer programme.

Does Google’s verification apply only to apps outside Play?

No. Registration is needed for Play apps too, but when the requirements are met they are registered automatically.

Do Apple’s new terms apply to all developers in the EU?

Yes. Apple announced that every developer distributing apps in the EU moves to a single set of business terms, and the key changes take effect on 1 October 2026.

Sources

This is what we do

How we help IT companies and app developers:

Publishing an App on the App Store and Google Play: What the Platforms Require from a Developer in 2026