Social login on iOS: when Apple requires an equivalent login option (guideline 4.8)

What guideline 4.8 says now

Read the current text before you plan the login screen. Apple's App Review Guidelines say an app that uses a third-party or social login service to set up or authenticate the user's primary account must also offer another login service as an equivalent option. Apple's examples include Facebook Login, Google Sign-In, Log in with X, Sign In with LinkedIn, Login with Amazon and WeChat Login.

The equivalent service has to meet three conditions. It limits data collection to the user's name and email address. It lets users keep their email address private when setting up the account. It does not collect interactions with your app for advertising without consent.

Two words carry the rule: primary account. Apple defines it as the account people set up with your app to identify themselves, sign in and use your features. Connecting Google Drive to import files is not that. Signing up with Google is.

Does your login screen need another option?

This is the decision table I would use. The last column is my reading of the guideline; App Review makes the final call.

A UAE detail: UAE PASS and the electronic ID exception

UAE PASS is the UAE's digital identity platform, and its developer documentation lists authentication as available to private organisations as well as government entities. Guideline 4.8 exempts apps that use a government or industry-backed citizen identification system or electronic ID to authenticate users.

So a UAE service app that signs people in only with UAE PASS looks like it fits that exception. I would not stretch it further. The moment you add a Google or Facebook button for residents without UAE PASS, or for visitors, I would add Sign in with Apple next to it.

Adding Sign in with Apple without breaking the rest

The button itself is quick. The edge cases take the time. These are the points I would plan for.

• Placement. Apple's Human Interface Guidelines say the button should be prominent, no smaller than other sign-in buttons, and visible without scrolling.
• The name arrives once. Firebase's docs say Apple shares the display name only the first time a user signs in, so save it on that first sign-in.
• Private relay emails. Users can hide their address behind a relay address. If your backend sends email, register your sending domain with Apple's private email relay service, or the messages will not arrive. Do not then ask for a personal email; Apple's Human Interface Guidelines advise against it.
• Android. A user who signs up with Apple on iPhone may open your Android app next. Firebase's Flutter docs cover Apple sign-in on Android and web, so offer the same button there.
• Duplicate accounts. Someone who signed up with Google on Android and then uses Apple with a relay address on iOS can end up with two accounts. Offer account linking, which Apple's Human Interface Guidelines suggest.
• Account changes. Apple can send server-to-server notifications when a user revokes consent or deletes their Apple Account. Handle those on your backend.
• Deletion. When an account created with Sign in with Apple is deleted, Apple's Human Interface Guidelines say to revoke its tokens.

The other social login rule, in 5.1.1(v)

Guideline 4.8 is not the only rule that touches social login. Section 5.1.1(v) adds three more.

If your app has no significant account-based features, people must be able to use it without a login. If the app connects to a social network, it needs a way, from inside the app, to revoke those credentials and stop data access between the app and the network. And the app may not store social network credentials or tokens off the device.

That last point surprises teams that keep a Facebook token on their server to post on the user's behalf. I would design around it from the start.

Login options in my app packages

Sign-up and login are in all three packages: Launch ($999), Growth ($1,699) and Scale ($2,500). If your login screen has a Google or Facebook button, I plan Sign in with Apple into the same scope rather than finding out at review. On Growth and Scale, the Node.js backend also handles relay email, account linking and Apple's notifications.

Store submission help is included, and while the launch offer runs I fix and resubmit at no cost if a review is rejected. Whether the app is approved is Apple's decision.