Account Deletion Requirement on the App Store and Google Play

If people can create an account in your app, both stores want them to be able to delete it from inside the app
Apple checks it under guideline 5.1.1(v), Google checks it through its User Data policy and the Data safety form
Deactivating the account does not count on either store
Deleting must remove the account and the data tied to it, and Google also wants a web link that works without the app

That's the whole rule
The rest of this post is how to build it once, properly, and how to prove it to App Review

In October 2026 one of my apps got rejected under 5.1.1(v) for exactly this
It had sign-in and no in-app account deletion
After I added it, Apple asked for a screen recording on a physical device showing the full flow
So this is written from the fix, not from theory

What Apple requires

Guideline 5.1.1(v) says that if your app supports account creation, you must also offer account deletion within the app (App Review Guidelines)

Apple's account deletion page spells out the details (Apple)

• Make the option easy to find, usually in account settings
• Delete the entire account record and the personal data tied to it
• Only offering to deactivate or disable the account is not enough
• If deletion finishes on your website, link straight to that page, not your home page
• If deletion takes time, tell the user how long and confirm when it's done
• If the law makes you keep some data, say what you keep and what you delete

Two details catch indie devs

Guest accounts count
Apple says people should be able to delete automatically generated accounts and their data too (Apple)

Subscriptions need a warning
If the user has an auto-renewable subscription, Apple wants you to tell them billing continues through Apple and ask them to cancel first (Apple)

You may ask the user to confirm, or enter a code sent to their email
But Apple says apps that make deletion unnecessarily difficult will not pass review, and unless you're in a highly regulated industry, don't make people call, email or chat with support to delete (Apple)

What Google Play requires

Google's rule is close, with one extra piece

Its User Data policy says apps that allow account creation must offer deletion both inside the app and through a web resource outside it (Google Play policy)
The same policy says temporary deactivation, disabling or freezing the account does not qualify as deletion

Google's help page on the requirement adds what the web link needs (Google Play Help)

• It must load without errors
• It must reference your app or developer name as shown on your Play listing
• The user must be able to actually request deletion through it
• You put the link in the Data safety form in Play Console

Why a web link if the app already has a button?
Google's answer is that a user who already uninstalled your app shouldn't have to download it again just to delete their account (Google Play Help)

You can keep some data for security, fraud prevention or legal reasons, as long as you tell users clearly what you keep (Google Play Help)

A simple page on your site with a short form, or a page that tells signed in users to tap Delete account and logged out users how to request it, is enough for a small app

What a deletion flow must actually do

The button is the easy part
What happens after the tap is what makes it real

1 Confirm and warn

One screen, one clear button, and a line about active subscriptions with a link to manage them

2 Re-authenticate

Firebase says deleting an account is a security-sensitive action that needs a recent sign-in, and fails with an error otherwise (Firebase docs)
So ask the user to sign in again right before deleting, instead of waiting for the error

3 Revoke Sign in with Apple

Apple says apps that support Sign in with Apple should use its REST API to revoke user tokens (Apple)
Firebase does not store Apple tokens, so the user signs in with Apple again, you take the fresh authorization code, and Firebase revokes it for you (Firebase docs)

4 Delete the server data

Firestore documents, Storage files, anything the user posted
Apple says people expect shared content like photos, posts and reviews to go too (Apple)

5 Delete the auth user

Last, because your security rules probably check request.auth before letting anyone delete those documents

Here's the short Flutter version for an Apple sign-in user

Future<void> deleteAccount() async {
  final auth = FirebaseAuth.instance;
  final user = auth.currentUser!;

  // Fresh sign-in: satisfies recent-login and gives a new Apple auth code
  final cred = await user.reauthenticateWithProvider(AppleAuthProvider());
  final code = cred.additionalUserInfo?.authorizationCode;
  if (code != null) await auth.revokeTokenWithAuthorizationCode(code);

  // Server data before the auth user, while rules still see request.auth
  await FirebaseFirestore.instance.doc('users/${user.uid}').delete();

  await user.delete();
}

The revokeTokenWithAuthorizationCode call is straight from the FlutterFire docs (Firebase docs)
For Google or email users, swap the reauthenticate step for that provider and skip the revoke

If a user has subcollections or Storage files, one document delete is not enough
Move the data part into a Cloud Function that deletes everything under the user's ID, and call it from the app

How to show it to App Review

This is the part Apple came back to me about

Apple's review prep page says to give working demo account credentials in App Store Connect, and to use the Notes field for anything extra reviewers need (Apple)
For account deletion, add these to Review Notes before Apple asks

• A demo account that is safe to delete, and a second one in case they delete the first
• The exact path, for example Settings, Account, Delete account
• What gets deleted and how long it takes
• A screen recording on a real iPhone: sign in, find Delete account, finish the deletion

In my case Apple asked for that recording after the rejection
Recording it up front costs five minutes and can save you a full review cycle

Deleting the account, not hiding it, is the rule on both stores

Pre-submit checklist

Check	Pass when
In-app button	Delete account is easy to find in account settings
Real deletion	Account record and user data are gone, not just flagged
Re-auth	Fresh sign-in happens before the delete call
Apple token	Revoked for Sign in with Apple users
Subscriptions	User is told billing continues and how to cancel
Google web link	Loads, names the app, accepts a request, is in Data safety
Review Notes	Demo account, path to the button and a device recording

If you want the other legal checks stores run before approving an app, they're in Before You Submit: Legal Checklist
And my App Store checklist covers three other blockers that a clean build never catches

FAQ

Is account deletion required on the App Store?

Yes, if your app lets people create an account
Guideline 5.1.1(v) requires that those apps also let people delete the account from inside the app

Is deactivating an account enough?

No
Apple and Google both say that only deactivating, disabling or freezing an account does not count as deletion

Does Google Play need a web link for account deletion?

Yes
Google wants a working web page where users can request deletion without reinstalling the app, and that link goes in the Data safety form in Play Console

Do I have to revoke Sign in with Apple tokens when deleting an account?

Apple says apps that support Sign in with Apple should revoke user tokens through its REST API
With Firebase, sign the user in with Apple again and pass the new authorization code to the revoke method before deleting the user

Can I keep some user data after the account is deleted?

Yes, if the law or fraud prevention requires it
Both stores want you to tell users clearly what you keep