Apple Bans Bait-and-Switch Apps in New Review Rules

Apple rewrote three parts of the App Review Guidelines on October 16, 2026 to go after apps that look harmless in review and turn into something else once approved, with "nudification" tools as the stated target ¹. The practical change for every developer is a new guideline, 2.5.19, that makes hidden, dormant or undocumented features grounds for removal from both the App Store and the Developer Program ².

The update lands three months after San Francisco's city attorney demanded that Apple and Google pull nudify apps, and after 2026 reports found dozens on the App Store, some rated for minors ^3,4. Apple's own framing is blunter than usual: it describes coordinated fraud operations that ship a clean build for review and switch on harmful features afterwards, and it says it blocked more than 150,000 unsafe apps and terminated over 193,000 developer accounts in 2025 ¹.

The three substantive changes, as Apple lists them ^1,2:

• Guideline 1.2 (user-generated content) now names nonconsensual intimate imagery, including AI-generated imagery, as content that apps must actively prevent and remove. Failing to put safeguards in place, or ignoring a notice, can now be treated as a Developer Code of Conduct violation.
• Guideline 2.5.19 (new) moves the long-standing ban on hidden functionality out of 2.3.1 into its own rule. 9to5Mac notes the text calls out code obfuscation as one way of concealing features ⁴.
• Section 5 (legal) states that apps facilitating human trafficking or child exploitation will be removed and also blocked from alternative distribution, which matters for EU, Japan and Brazil marketplaces.

The same release adds guideline 2.3.14 for the new creative-asset formats and folds the music-streaming entitlement into 3.1.1(a) ².

Also today

• Google Play's October 13 update added side-by-side app comparisons in Ask Play, a personalised Game Finder for US English users, 48-hour "Sprints" for 2–5 matched players, and said Play recommendations inside Gemini drove over 6 million installs in two months ⁵.
• The Apps Experience and Level Up reduced-fee programs are now live in Australia, Japan, the EEA, the UK and the US, with Korea due by end of 2026, and enrollment moved into Play Console ⁵.
• Apple's October 13 Developer Program License Agreement revision adds terms for the Live Assistance API, App Replacement Entitlement, HomeView widgets and multi-seat subscriptions via Group Purchases ⁶.
• iPhone Duo ships October 23, 2026, and Apple is asking developers to test folded and unfolded layouts in Xcode 27.1 before then ⁷.
• Cal AI's founder told TechCrunch Disrupt the calorie app passed $30 million in revenue in two years largely on paid micro-influencers with tight communities, before MyFitnessPal bought it in March 2026 ⁸.

On the charts

Today's snapshot is the first in the new AppWinners collector, so movers lists are empty until tomorrow; this is the state of the US top free charts on October 19, 2026, not day-over-day change.

• Muse from Meta is No. 1 on iOS and No. 1 on Google Play; 9to5Mac reported on October 7 that it had already held the iPhone top spot for weeks after a September launch ⁹.
• TikTok Pro – Events sits at No. 5 on iOS and No. 4 on Android, while TikTok's short-drama spin-off PineDrama is No. 7 on iOS. Short drama is now a crowded shelf: FreeReels, DramaWave, BlinkDrama, FreeDrama, ReelShort and DramaBox all appear in the Android top 40.
• Meowdoku! from Oakever Games is No. 4 on iOS, the highest-ranked game on either store today, ahead of Grand Games' Block Out! at No. 9.
• Kalshi is No. 8 on iOS and No. 16 on Android; football season keeps prediction markets in the top 20.
• On Android, Settings Home at No. 3 shows launcher-style utilities still pulling big volume.

Full lists: iOS top free and Android top free.

What developers are talking about

One account, 293 apps. An r/iOSProgramming post showing a developer page with 293 published apps, most from the last five months, drew 97 upvotes and a thread on how template spam clears review ¹¹. It is the pattern Apple's new 2.5.19 language is aimed at.

Cloned from a decompiled APK. The top r/androiddev post this week (236 upvotes) is a post-mortem from a team whose app was pulled from Play, injected with an ad SDK and reposted on an APK mirror ¹². The author found that R8 had renamed classes but left every string intact, including a search-provider key with write access and a two-year-old staging auth header that still worked.

Do Play policies apply to big apps? A solo developer asked why a major scanner app appears to offer rewards for ratings despite Google's rule against incentivised reviews, and whether anyone has seen enforcement against a large publisher (103 upvotes, 25 comments) ¹³. No one in the thread cited a confirmed case, so treat that claim as unverified.

Elsewhere, a 315-comment Hacker News thread on a Developer Forums report that a macOS 15.8.2 build breaks OpenGL became an argument about Apple's bug-report process; commenters say the build is a release candidate, not a shipped update ¹⁰.