Troubleshooting: My App Was Rejected by Apple Due to CMP and ATT Usage

Apple may reject your app for the following reasons when using a CMP alongside the ATT framework:

Confusion Between ATT and Cookie Consent Prompts

In some cases, Apple reviewers may interpret the ATT prompt and the consent prompt from your CMP (e.g., IAB TCF UI) as overlapping or conflicting.

Misalignment Between CMP Purpose and Apple's Expectations

Apple reviewers may not always recognize that the IAB Transparency & Consent Framework (TCF) covers broader use cases beyond tracking, such as legitimate interest processing, functional purposes, and other user preferences.

Use of the Term “Cookies”

Apple has flagged apps for referencing "cookies" even though the term may not accurately describe the data collection taking place on iOS apps.

To improve your chances of App Store approval, we recommend the following steps, all of which can be configured directly in your OneTrust tenant without any code changes:

1. Enable Category-Purpose Linking for ATT

   Link your ATT consent to the relevant cookie category (e.g., "Marketing") so that:

   • If a user rejects ATT, the associated category is automatically turned off.

   • The user will be required to consent to ATT before the category can be turned on.

   This approach ensures clear alignment between the ATT selection and your CMP logic, providing transparency and reducing ambiguity for reviewers.

   For example user journeys, see App Tracking Transparency User Journey Configurations.

2. Clarify the Difference Between ATT and CMP Prompts

   In your app review notes to Apple, clearly state:

   ATT Prompt

   : This is required to request permission for tracking across apps and websites.

   CMP (IAB TCF) Prompt

   : This is necessary to obtain consent for additional purposes as defined by the IAB TCF (e.g., personalized ads, analytics, content selection).

   These are two separate consent flows that serve different purposes and may be legally required depending on your app’s audience and jurisdictions.

3. Avoid Using the Word “Cookies”

   Consider replacing “cookies” with broader or platform-appropriate terms such as:

   • "Technologies"

   • "Data collection methods"

   • "Preferences"

   This helps prevent confusion since cookies are not technically used in native iOS apps.

4. Add Clarifying Text to the CMP UI

   Use the Additional Description field in your banner settings to clarify the distinction between Apple’s ATT and your CMP. We suggest adding language like:

   "The rights and choices described below are separate from, and in addition to, your Apple App Tracking Transparency (ATT) choice. Your ATT selection will be honored independently of any choices you make below."

   This provides reassurance to both users and reviewers that your implementation is respectful of Apple’s privacy framework.

Clients who implemented these suggestions have seen their app approvals go through successfully, without needing to alter any core app logic or introduce new code. These adjustments can be made entirely through OneTrust configuration.

If you have any questions or would like help making these updates in your OneTrust tenant, please reach out to your support contact or integration specialist.