App Rejected for Permissions: How to Request Only What You Need

The Permission Principle

Both platforms enforce a minimum-permissions principle: only request permissions your app actually uses, request them at the time they are needed (not all at launch), clearly explain why each permission is needed through purpose strings, and gracefully handle permission denial without breaking the app. Violating any of these triggers rejection.

Common Permission Rejection Causes

Requesting location permission without location-based features, camera or microphone access without recording or scanning features, contacts access without a clear social or sharing purpose, health data access without health-related functionality, background location without continuous location need, and push notifications requested before the user understands why. Third-party SDKs sometimes request permissions your app does not visibly use, which also triggers rejection.

Writing Effective Purpose Strings

iOS requires NSUsageDescription strings in Info.plist for each permission. These must clearly explain in user-facing language why the permission is needed. Bad: "This app needs your location." Good: "NoReject AI uses your location to show app development meetups and compliance resources near you." Google requires similar justification in your Data Safety section and manifest declarations.

Frequently Asked Questions

Related Resources