Apple requires account deletion within apps in AppStore starting January 31

> I'm surprised it still does not have a law to require online unsubscribe for media subscriptions.

Newspaper editorial endorsements are still a big thing in Canada.

> The Globe and Mail operates similarly.

But this is good to know. I was considering swapping another newspaper subscription for a Globe and Mail subscription, but after looking into it, the eventual unsubscribe hassle isn't worth it.

It sounds like you’d like to work at Apple and help them improve their guidelines process. They don’t offer what-if examples, and they note that it’s by design that the guidelines are not detailed to the level you’re asking, so that they have the flexibility to make judgment calls and prevent rules-lawyering problems that crop up with the more detailed approach you seek.

1. Auth tenant. Common sense says that if the auth provider is operated by you, it’s your problem to handle deletions appropriately, either by removing their account or by warning the user that you’re only deleting the specific site account and providing a link to delete the SSO account at your website or whatever. If you do not operate the identity provider, such as Facebook, then you need do nothing about it at deletion time. Apple would likely approve any of those paths without comment, but to defend against rules lawyering and loophole seeking, there’s no way to be perfectly certain until it’s approved.

2. Banking or healthcare app. If you can sign up in-app, you’ll need to let people close/delete in-app, except where prohibited by contract or law. For corporate healthcare, you would pop a dialog that says “This account can only be closed through your employer”, which would be absolutely sufficient. Ditto for a banking account with non-zero balances or a safety deposit box or whatever. It seems likely Apple will not have cause to enforce the deletion clause against brick and mortar banks, since they all have help/faqs on how to close accounts already. App-only banks will be held to the more strict standard of having some way to initiate deletion, being app-only, though of course they’ll retain financial audit records as required by law.

3. Deleted means that all information not essential to compliance with financial and other auditing laws has been removed from your systems. Exceptions are understood to exist for recording that someone requested deletion, but you can’t use those records for marketing or training AI or any other purpose beyond managing your deletions. If you can’t explain in plain simple English how you handle deletions, they’re likely to reject your submission until you can.

All of this is obvious. It isn’t comfortable to consider that you’re at the mercy of human beings to evaluate your compliance — human beings that see a thousand scams a minute trying to hack loopholes in the guidelines. But that’s how it is today.

How is this supposed to work for insurance or banking apps? I would think those companies separate your "online account" from your actual account with them or something like that. I guess more generally how will this affect apps where "deleting your account" is a complicated affair (insurance, banking, mobile service, utilities, etc).

They don't have the right to my attention. If they were to cancel my service due to lack of payment (for example), do you think they would engage me in a dialogue to discuss it or just send me a notice in the mail?

From the guidelines:

> (v) Account Sign-In: If your app doesn’t include significant account-based features, let people use it without a login. If your app supports account creation, you must also offer account deletion within the app. Apps may not require users to enter personal information to function, except when directly relevant to the core functionality of the app or required by law. If your core app functionality is not related to a specific social network (e.g. Facebook, WeChat, Weibo, Twitter, etc.), you must provide access without a login or via another mechanism. Pulling basic profile information, sharing to the social network, or inviting friends to use the app are not considered core app functionality. The app must also include a mechanism to revoke social network credentials and disable data access between the app and social network from within the app. An app may not store credentials or tokens to social networks off of the device and may only use such credentials or tokens to directly connect to the social network from the app itself while the app is in use.

Also interesting:

> (viii) Apps that compile personal information from any source that is not directly from the user or without the user’s explicit consent, even public databases, are not permitted on the App Store.

So why is Facebook still allowed? It still creates shadow profiles without permissions as far as I know.