App Account Deletion Requirement: Complete Guide for iOS & Android (2026)

Both Apple and Google now require apps that let users create accounts to also let them delete those accounts. This applies to every app on the App Store and Google Play, with no exceptions for app size or category. If your app has a sign-up flow, it must have a deletion flow. This guide covers exactly what each store requires, how to implement it, common mistakes that cause rejections, and how to stay compliant as the rules evolve in 2026.

Why the Stores Require Account Deletion

The push for in-app account deletion comes from privacy regulations worldwide. GDPR gives EU users the right to erasure. CCPA gives California residents the right to delete personal information. But beyond legal pressure, Apple and Google recognized that many apps made it intentionally difficult to leave: users had to email support, wait days, or navigate obscure web forms. The account deletion requirement fixes this by making the exit path as clear as the entry path.

For developers, this is not optional. Apps submitted without account deletion will be rejected during review. Existing apps that do not comply risk removal from the store. The requirement has been enforced since mid-2022 on Apple and since early 2024 on Google Play, so there is no grace period left.

Apple's Requirements (App Store Review Guideline 5.1.1(v))

Apple's rule is straightforward: if your app allows account creation, it must also allow users to initiate deletion of their account from within the app. The key word is "initiate" — Apple does not require instant deletion, but the process must start inside the app itself.

Specifically, Apple requires the following:

In-app initiation — Users must be able to find and start the deletion process without leaving the app. A button in Settings or Account is the most common approach. Directing users to a website or asking them to email support is not sufficient.
Clear and findable — The option must be easy to find. Burying it behind multiple screens or requiring the user to contact support first will result in rejection.
Complete deletion — You must delete the account and associated data, not just deactivate it. If you need to retain certain data for legal reasons (tax records, fraud prevention), you must explain what you retain and why.
Sign in with Apple — If your app uses Sign in with Apple, you must also revoke the user's token when deleting their account. Apple provides an API for this (REST API endpoint to revoke tokens). Failing to revoke the token means the user's Apple ID remains linked to your app even after account deletion.
Consistent experience — The deletion process should work the same way regardless of how the user signed up (email, Apple ID, Google, Facebook, etc.).

Google Play's Requirements

Google's requirements are broader in one important way: you must provide account deletion both inside and outside the app. Google requires two paths because users should not have to reinstall an app just to delete their account.

In-app deletion — Same as Apple. Users must be able to request deletion from within the app.
Web-based deletion — You must also provide a web page where users can request deletion without having the app installed. This URL is displayed on your Play Store listing in the Data Safety section.
Data Safety form — You must answer the account deletion questions in your app's Data Safety form in Play Console. This includes providing your deletion URL and describing what data is deleted vs. retained.
Associated data — When deleting an account, you must also delete the data associated with it. If you use third-party services that store user data (analytics, crash reporting, etc.), you should delete data from your servers and request deletion from those services as well.
Timeframe — Google does not specify an exact timeframe, but the process should be reasonable. Industry standard is within 30 days, and you must communicate the expected timeframe to the user.

How to Implement Account Deletion

The implementation has two parts: the user-facing flow and the backend process.

User-Facing Flow

Place a "Delete Account" or "Delete My Account" option in your app's account settings or profile screen. When tapped, show a confirmation screen that explains what will happen: what data will be deleted, whether the process is reversible, and how long it takes. Require explicit confirmation (a button tap, not just a toggle). After confirmation, show a success message with the expected timeframe.

For the web-based path (required by Google), create a dedicated page at a stable URL like yourapp.com/delete-account. The page should have a simple form: email or account identifier, optional reason, and a confirmation checkbox. This is exactly what App Club generates for every project at {slug}.app-club.org/delete-account.

Backend Process

When a deletion request comes in, your backend should: mark the account for deletion, start a grace period if you offer one (7-30 days is common, during which the user can cancel), then permanently delete or anonymize all personal data. If you retain anything (e.g., transaction records for tax purposes), document what you keep, why, and for how long.

Remember to also handle downstream services: revoke OAuth tokens (Sign in with Apple, Google, Facebook), delete data from analytics platforms where possible, remove user-generated content or anonymize it, and cancel any active subscriptions or notify the user to cancel them first.

Common Mistakes That Cause Rejections

Based on patterns from App Store and Play Store reviews, here are the most frequent reasons apps get rejected for account deletion issues:

Hiding the option — The delete button exists but is buried so deep that reviewers cannot find it. Put it in an obvious place: Settings > Account > Delete Account.
"Contact support to delete" — Redirecting users to email or a chat bot instead of providing an in-app mechanism. This does not meet the requirement.
Deactivation instead of deletion — Offering to "deactivate" or "disable" the account but not actually deleting the data. The stores require real deletion.
Missing web path (Google only) — Having in-app deletion but no web-based option. Google requires both.
Not revoking Apple tokens — Deleting the account but not revoking the Sign in with Apple token. This triggers a specific rejection from Apple.
No confirmation or feedback — The user taps delete but gets no confirmation that anything happened. Always confirm the action and provide a timeframe.

What About Subscriptions?

Account deletion does not automatically cancel subscriptions managed by the stores (App Store or Google Play). This is a frequent source of user complaints. When a user requests account deletion, you should check for active subscriptions and either cancel them on your end (if you manage billing) or clearly instruct the user to cancel their subscription through the store before proceeding. Apple specifically notes that you should remind users about active subscriptions during the deletion flow.

Legal Considerations

Some data cannot be deleted immediately due to legal obligations. Tax records, financial transaction history, and data needed for ongoing legal disputes may need to be retained. In these cases, you should delete or anonymize everything you can, clearly disclose in your privacy policy and deletion flow what you retain and the legal basis for retention, and set a retention schedule so the data is deleted when the legal obligation expires.

Your data deletion instructions page (which App Club generates automatically) should explain this clearly so users know exactly what happens when they request deletion.

2026 Updates: What Is Changing

Both stores continue to tighten enforcement. In 2024, Google added the Data Deletion badge to Play Store listings, making it visible to users whether an app supports proper deletion. Apple has been increasingly strict during review, rejecting apps that technically have a delete button but make the process confusing or incomplete.

New state-level privacy laws in the US (Texas, Utah, Louisiana, California) are adding requirements around age verification and parental consent that interact with account deletion — for example, if a minor's parent requests deletion, you must comply. The general direction is clear: account deletion is becoming a baseline user right, and enforcement will only increase.

Quick Implementation Checklist

Add "Delete Account" button in app Settings or Account screen.
Show confirmation with clear explanation of what happens.
Create a web-based deletion page (required for Google Play).
Update your Data Safety form in Play Console with the deletion URL.
Implement backend deletion: personal data, associated content, third-party service data.
Revoke OAuth tokens (Sign in with Apple, Google, Facebook).
Handle active subscriptions: warn users or cancel on your end.
Update your privacy policy to describe the deletion process and any retained data.
Test the full flow before submitting for review.

App Club generates the web-based deletion request page, the data deletion instructions document, and the privacy policy sections that describe your deletion process — all from a single set of project settings. If you need these documents for your app, you can create them in minutes.