Four App Store policy changes from summer 2026 that need action

Apple added social-media age-rating questions, EU terms with a 5% CTC, a private.icloud.com relay domain and an EU ATT prompt. Here is what to update.

App StoreiOSSign in with AppleEU

Between July and September 2026, Apple changed four rules that reach into your code, your backend and your pricing. The age-rating questionnaire gained social-media questions, the EU business terms were rewritten, Sign in with Apple got a new relay domain, and a second App Tracking Transparency prompt is coming to five EU countries. None of these is a headline feature, and each one can block an update, break sign-up or change your margins if you miss it.

What changed

Social-media questions in the age rating

On July 9, 2026, Apple added social-media questions to the age-rating questionnaire. Apple's definition is broad. It covers any feature that lets people redistribute, amplify or interact with content created by other users through a social feed or a similar way of discovering it.

Answering became required in September 2026 for new apps, app updates and notarization for alternative distribution. Apps that answer yes receive a Social Media content descriptor and fall under the new Time Allowances in iOS 27.

One set of EU business terms

On August 18, 2026, Apple announced a single set of EU business terms for all developers, effective October 1, 2026. Apple says the changes followed "close collaboration with the European Commission". The main points:

The per-install Core Technology Fee is replaced by a Core Technology Commission (CTC) of 5% on digital transactions in apps distributed outside the App Store.
The Initial Acquisition Fee and the Store Services Fee are removed.
Apps can offer alternative payment options alongside Apple In-App Purchase.
Alternative payments get child-safety protections.
More developers qualify to run alternative marketplaces or distribute on the web.

Apple published an updated Apple Developer Program License Agreement the same day.

A new Sign in with Apple relay domain

On August 24, 2026, Apple said new Sign in with Apple relay addresses will use private.icloud.com. Existing addresses on privaterelay.appleid.com keep working. Apple asks developers to update their validation logic and allowlists.

An alternative ATT prompt in five EU countries

On September 16, 2026, Apple announced an alternative App Tracking Transparency prompt in the EU, starting with iOS and iPadOS 27.2. It is required only in Germany, France, Italy, Poland and Romania, under agreements Apple reached with select European competition authorities.

Separately, Apple announced age-rating updates for the Republic of Korea on August 12.

What it means for your app

Feeds and comments count

The social-media definition covers far more than social networks. If your app has comments, a community section or sharing that surfaces other people's content, assume the questions apply and answer them carefully. Skip them and your updates are blocked. Answer yes and your app carries the Social Media descriptor and falls under Time Allowances, so product and support teams should know about it before the answer goes in.

Relay email validation is a sign-up risk

This is the change most likely to fail quietly. Any backend that checks the relay domain, for example to detect private emails, route transactional mail or approve sign-ups, must accept private.icloud.com. If it only knows privaterelay.appleid.com, new users fail sign-up while existing users keep working, which makes the bug easy to miss in testing.

EU fees and payments need a fresh model

If you distribute in the EU outside the App Store, redo your fee math. A commission on digital transactions scales with revenue, while a per-install fee scaled with downloads, so the result depends heavily on your business model. App Store-only apps are outside the CTC. The option to offer alternative payments alongside In-App Purchase still applies to them, so weigh it against the extra payment integration and the child-safety protections that come with it.

Consent flows will diverge by country

From iOS 27.2, users in Germany, France, Italy, Poland and Romania will see a different ATT prompt. If you track opt-in rates, segment them by country and OS version, so a shift in those five markets does not look like a product problem. If you show your own explanation screen before the system prompt, review its wording once the new prompt is available.

A practical checklist

Answer the social-media age-rating questions for every app in App Store Connect before your next submission, and agree on the answer with whoever owns the product.
Search your backend and client code for privaterelay.appleid.com, add private.icloud.com wherever it appears, and add a test that signs up with the new domain.
Check email tooling, CRM imports and fraud rules for the same hard-coded domain.
Read the updated Apple Developer Program License Agreement published on August 18.
If you distribute in the EU outside the App Store, model your costs under the 5% CTC. For every EU app, decide whether alternative payments are worth the integration work.
Prepare for the iOS 27.2 ATT prompt in the five countries, and split consent analytics by country.
If you publish in the Republic of Korea, review the August 12 age-rating updates.

My take

The Sign in with Apple change is the one I would fix first. It takes minutes, and the failure mode is new users who cannot register while your dashboards look normal. The age-rating questions come second, because they block updates outright and the answer has product consequences.

On paper, the EU terms are a simplification: one set of terms for everyone, two fees removed and a percentage in place of a per-install charge. The ATT news points the other way. A prompt that differs in five countries, under separate agreements with competition authorities, means EU behavior will keep fragmenting by market.

My advice is to keep EU-specific logic behind clear configuration, keyed by country and OS version, so the next country-level change touches configuration only.