Guideline 5.1.1 Purpose String Rejection: How to Fix It

What this rejection means

When the app asks for the camera, photos, location, microphone or contacts, the sentence in the system prompt must say what the app does with it, with an example. “This app needs camera access” is not enough.

Why reviewers send it

Permission prompts show the purpose string from Info.plist. Apple wants it to tell people what the app does with the access, with an example — generic text added by a plugin’s setup guide, such as “This app needs the camera”, gets rejected.

The message App Review sends

Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage

We noticed that your app requests the user’s consent to access the camera, but doesn’t sufficiently explain the use of the camera in the purpose string.

The exact wording changes from one review to the next; the guideline number is what to look for.

How to fix it

Rewrite each usage description in ios/App/App/Info.plist (NSCameraUsageDescription, NSPhotoLibraryUsageDescription, NSLocationWhenInUseUsageDescription…) as a specific sentence: what for, with an example.
Remove permissions the app doesn’t use — plugin setup guides can add keys you don’t need.
Ask for a permission when the person uses the feature, not at launch.
Upload a new build.

A purpose string that is missing entirely blocks the upload instead: see ITMS-90683.

Fix it with Lovable, Bolt or Cursor

If the app was built with an AI builder, paste this into it, then check the result on a phone:

Ask for camera, photo and location permission only when the user taps the feature that needs it, never at launch. In ios/App/App/Info.plist, rewrite each NS…UsageDescription as a specific sentence that says what the app does with it and gives an example.

What to reply in App Store Connect

Replace the [brackets] with what you actually changed:

Guideline 5.1.1 — We rewrote the purpose strings to explain how each permission is used. For example, the camera: “[App name] uses the camera to scan receipts and attach them to your expenses.”

Got a different message?

Paste the whole rejection into the rejection explainer. It recognises this one and 26 others, in your browser — nothing is uploaded.

Guideline 5.1.1: permission purpose string