App Store Guideline 5.4 explained: VPN Apps

Guideline 5.4 applies to apps that offer VPN services. They must use the NEVPNManager API, and they may only be offered by a developer enrolled as an organization. An individual Apple Developer account cannot ship a VPN app.

Before the user pays or turns the VPN on, an in-app screen has to say what user data is collected and how it is used. The privacy policy has to commit that the app will not sell, use, or disclose that data to third parties for any purpose.

The app must not violate local law. If you distribute in a territory that requires a VPN license, put the license information in the App Review Notes field. Parental control, content blocking, and security apps from approved providers may also use NEVPNManager. Using the API, or the word VPN, for a different product is the bait case reviewers reject.

The binary is a real tunnel via NEVPNManager (a Network Extension), not a web proxy, a Smart DNS, or an in-app browser that only routes some traffic.

The seller is an organization, and a data-use declaration is on screen before purchase and before connect. The privacy policy and the App Privacy label match that screen.

The name, subtitle, screenshots, and description describe the VPN the build actually provides. A country list, a speed claim, or a 'free unlimited' offer that the binary cannot deliver is bait, and it fails review even when the tunnel itself is real.

App Review notes include license details for every storefront that requires a VPN license, and the steps to connect.

The app is labeled a VPN but implements a proxy, DNS changer, or browser without NEVPNManager.

The app is submitted from an individual developer account.

There is no in-app disclosure of collected data before the paywall or the connect button, or the privacy policy says VPN data may be shared with advertisers or other third parties.

Metadata overclaims: unblock any site, servers the build cannot reach, or a free VPN that is paywalled before it works.

The app is on sale in a territory that requires a VPN license, and App Review notes do not include the license.

Ship a NEVPNManager tunnel. In App Review notes, say that you use it and give the taps to turn it on.

If the app is on an individual membership, move it to an organization account before you resubmit.

Add a screen, before purchase and before connect, that lists what the VPN collects and how it is used. Make the privacy policy say you will not sell, use, or disclose that data to third parties for any purpose.

Remove bait from the name, subtitle, screenshots, and description. If a storefront requires a license you do not have, remove that storefront and paste the licenses you do have into App Review notes.

Confirm the build number uses NEVPNManager. Point to the data-disclosure screen and the connect control.

If Apple called the listing misleading, name the metadata or screenshot you changed and what the build actually does.

If the issue was a license or the account type, state the organization name and quote the license details already in App Review notes. Apps that miss 5.4 can be removed from the store, so do not resubmit a proxy still labeled as a VPN.