How to fix a 4.8 rejection, step by step
Follow these steps in order. Each one is something we do on client work.
- Check which login triggered it. 4.8 applies when a third-party or social login (for example Google Sign-In) sets up the user's primary account.
- Add an equivalent login option. Read 4.8 for the privacy requirements the alternative must meet; Sign in with Apple is the common choice.
- Check the exceptions. 4.8 lists cases like your own account system only, or certain enterprise and education apps.
- Place buttons equally. Make the option as visible as the others.
- Handle private relay email. Users may hide their email; support it.
- Reply with where to find it. Point to the login screen.
Guideline 4.8 rejection: key rules and context
What the rejection means. Guideline 4.8 (Login Services) is in the Design section (Review Guidelines). The equivalent option must limit data to name and email, let users keep their email private, and not track without consent.
Why it usually happens
- Google and Facebook buttons only.
- Sign in with Apple present on iOS but hidden on some screens.
- The Apple button styled smaller or lower than others.
How to fix it
- Add Sign in with Apple (or another qualifying option).
- Show it wherever other social logins appear, with equal prominence.
- Handle hidden "private relay" emails in your backend.
- Add account deletion and token revocation (5.1.1(v)).
What to tell the reviewer. Reply with the screens where the new option appears and the build number.
How to avoid it next time. Plan login options with Apple's rule in mind from the first design.
Worked example (hypothetical)
This example is illustrative. The app is made up, and so are any numbers in it.
Imagine TeamBoard offers Google and LinkedIn login only. We'd add Sign in with Apple next to them, test the relay-email path, and reply: "Sign in with Apple is now available on the first screen."
Common mistakes
- Hiding the new button. It should be as visible as the others.
- Breaking accounts with relay email. Test it.
- Assuming email/password exempts you. Read the exact exceptions.
- Forgetting account deletion. 5.1.1(v) still applies.
If you want this handled for you, our pricing page lists every fixed package.
The guidelines behind most rejections
The table maps each point to the guideline 4.8 rejection context. Compare the guideline number in your rejection message with the matching row. Apple revises the guidelines, so open the live document before you reply to App Review.
| Guideline | What it covers | Usual fix |
|---|---|---|
| 2.1 App Completeness | Final builds, working URLs, no placeholder content | Fix crashes, add a demo account, test every link |
| 2.3 Accurate Metadata | Description, screenshots and previews reflect the app | Re-shoot screenshots from the real app; remove claims you can't show |
| 2.3.7 | Unique name, accurate keywords, no trademarked or irrelevant terms | Remove competitor names and pricing from metadata |
| 3.1.1 In-App Purchase | Digital features and content unlocked via IAP | Move digital unlocks to StoreKit IAP |
| 4.2 Minimum Functionality | More than a repackaged website | Add native, useful features |
| 4.3 Spam | No duplicate bundle IDs or saturated copycat apps | Consolidate apps; show what is unique |
| 5.1.1 Data Collection and Storage | Privacy policy, permissions, account deletion (5.1.1(v)) | Add policy links, clear purpose strings, in-app deletion |
Checklist
Copy this list into your release notes or ticket and tick each item off before you ship.
- Third-party logins listed
- Equivalent option added
- Exceptions checked
- Buttons equally visible
- Relay email tested
- Account deletion in app
Sources
- Apple: App Review Guidelines (accessed 26 October 2026)
- Apple: Offering account deletion in your app (accessed 26 October 2026)
Questions
Is Sign in with Apple mandatory?
Not strictly; an equivalent option meeting Apple's criteria is required if you offer third-party login.
Exempt cases?
Apps using only their own account system, education/enterprise accounts, government ID and some others.
Must the button be equal?
Equivalent prominence is expected.
What about relay emails?
Your backend must accept them.
Can you help implement it?
We give exact guidance; hands-on is available by email.
Does email and password login need Sign in with Apple?
4.8 targets third-party or social logins used for the primary account. Read the current list of exceptions for your setup.