Apple no longer requires apps with third-party login services to also use Sign in with Apple; now they must offer an additional login with some privacy features
There's another small but notable change coming to the App Store. Apple has revised its App Store guidelines to remove …
Context & Ripple Effects
Apple originally made its privacy-preserving sign-in service compulsory for iOS apps that used third-party authentication, following its 2019 launch of Sign in with Apple. The latest guideline revision preserves a privacy standard while changing the mechanism developers must use to meet it.
The change fits a wider pattern of App Store rules governing account control, including the later requirement that apps offering account creation provide in-app account deletion. Apple remains the rule-setter, but is loosening a mandate tied to its own identity product.
First-order effects
- Apps using third-party sign-in no longer have to add Sign in with Apple specifically; they must instead provide another login choice with the required privacy features.
- Developers gain latitude in authentication implementation, while users retain access to a privacy-oriented alternative login path.
Second-order effects
- Third-party identity providers and app developers can compete on the qualifying privacy features rather than treating Apple integration as an unavoidable addition to their login flows.
- Apple’s sign-in service loses a distribution advantage created by the former requirement, even as the App Store continues to set the minimum privacy terms for access.
Third-order effects
- The policy points toward outcome-based App Store governance: Apple can mandate user protections while leaving more room for developers to choose the technical provider.
- If applied more broadly, this approach could reduce platform self-preferencing concerns without reducing the App Store’s ongoing control over developer policy—though this change alone does not establish a wider shift.
The trend: App platforms are increasingly separating privacy and user-control requirements from mandates to adopt the platform owner’s own service.