What Keel scores in the Kids Category, and what it does not

Apple publishes 125 numbered guidelines. Keel scores duties from 10 of them. The other 115 are out, and this page is every one of them by number, so you can disagree with a specific line instead of with a total.

The rule

A guideline is scored here only where its duty is triggered by a child, a minor, an underage user, or by the Kids Category. Everything else is out, however much it matters to an app that happens to serve children.

One stated extension, used once. A guideline that is not child-triggered is in scope only where a child-triggered duty incorporates it by reference and would otherwise be unscoreable. That is Guideline 5.1.1(i) alone: Guideline 5.1.4(b) requires a privacy policy of Kids Category apps and of any app handling a minor’s data, and 5.1.1(i) is the only place Apple states what such a policy must contain.

Out of scope is not the same as inapplicable. This is not a claim that the excluded guidelines do not apply. Every one of Apple’s 125 guidelines binds the developer, and breaking one gets an app rejected whether or not Keel scores it. Keel scores the duties a children’s-privacy program is accountable for, and names the ones it left out.

Scored only in part

These guidelines are in scope for the duty named and no further. The unscored remainder of each is written out, because "partially scored" is otherwise a hedge rather than a claim.

• 1.2.1 Triggered by something other than serving a child
  Scored: Only (a), the age-restriction duty on creator content.

  Not scored: The creator-content moderation rules and the monetization rules the guideline points at. Both are general and are triggered by hosting creator content rather than by a child.

• 1.4.3 Triggered by something other than serving a child
  Scored: Only the sentence rejecting apps that encourage MINORS to consume tobacco, vape products, illegal drugs or alcohol.

  Not scored: The general prohibition on encouraging consumption, and the separate rule on facilitating the sale of controlled substances or tobacco. Neither is triggered by a child.

• 2.3.8 Binds every app regardless of audience
  Scored: Only the “For Kids” and “For Children” metadata reservation.

  Not scored: The rule holding metadata imagery to a 4+ age rating whatever the app’s own rating, and the app-name to icon consistency rule. Both bind every app.

• 2.5.13 Binds every app regardless of audience
  Scored: Only the alternate authentication method for users under 13.

  Not scored: The duty to use LocalAuthentication rather than ARKit or other facial recognition technology where possible, which binds every app regardless of user age.

• 2.5.18 Binds every app regardless of audience
  Scored: Only the prohibition on targeted or behavioral advertising based on data from kids.

  Not scored: Confining display ads to the main app binary, matching ads to the app’s age rating, interstitial-ad conduct, close and skip buttons, and the route for users to report inappropriate ads. All bind every app.

• 5.1.1 Binds every app regardless of audience
  Scored: Only (i), and only through the incorporation extension above, because Guideline 5.1.4(b) cannot otherwise be evidenced.

  Not scored: (ii) through (x). These are Apple’s general privacy duties and bind every app whatever its audience. Note (x) names kids and is still out: it cross-references limits scored here at 1.3 and 5.1.4 rather than creating a new duty.

• 5.1.3 Binds every app regardless of audience
  Scored: Only (iii)’s minors branch: parent or guardian consent where a participant in health-related human subject research is a minor.

  Not scored: (i), (ii), (iv), and the adult-consent duty in (iii). Also the limits on using health and fitness data for advertising or data mining, the prohibition on writing false data into HealthKit or storing personal health information in iCloud, and the independent ethics review board requirement. All bind every health research app regardless of participant age.

The near misses

Each of these mentions children somewhere and is still out. They are the calls most worth checking first, which is why they are named rather than absorbed into the count above.

• 1.1.4 Triggered by something other than serving a child
  Human trafficking and exploitation

  Not child-specific on its face. The duty is owed whoever the victim is.

• 1.2 Triggered by something other than serving a child
  User-generated content, bullying and abusive users

  General, and triggered by hosting user-generated content rather than by a child.

• 1.5 Binds every app regardless of audience
  Developer contact information

  Apple says it is “particularly important for apps that may be used in the classroom”. Classroom use is emphasis, not a trigger; the duty is identical for every app.

• 2.3.6 Binds every app regardless of audience
  Answer the age-rating questions honestly

  The closest call in the document. Excluded because its trigger is submitting ANY app, not serving a child: every developer owes it identically. The Kids-Category-triggered age duty is a different one and IS scored, at 1.3/age-band.

• 2.5.2 Triggered by something other than serving a child
  Educational apps downloading executable code

  Triggered by downloading code in a teaching app. Students are not necessarily minors.

• 3.1.3 Triggered by something other than serving a child
  Payment-method eligibility, including classroom and family sales

  Names “students”, “classroom management tools” and “family sales”, so it reads as child-adjacent. Eligibility for the alternative payment methods turns on the business model an app operates, not on whether a child uses it, and an app serving no children can meet every condition in it.

• 4.1 Triggered by something other than serving a child
  Copycats

  Matched a token scan on “minor changes” — the adjective, not a person. There is no child duty in Copycats at all.

• 4.7.1 Points at a duty scored elsewhere here
  Mini apps and games must follow the privacy guidelines

  Triggered by offering mini apps or games, with “personal data from kids” only as a parenthetical example. The duty it points at is Guideline 5.1, so scoring it would double-count.

• 4.10 Triggered by something other than serving a child
  Monetizing built-in capabilities

  Matched only because Section 5’s preamble (“exploitation of children”) follows it in the page text. A preamble is not a numbered duty.

• 5.1.2 Binds every app regardless of audience
  Data use and sharing, including ClassKit

  General privacy duties with no child trigger. Excluding this while scoring all of 5.1.1 would have been incoherent, which is what forced 5.1.1 down to (i) alone.

• 5.4 Permits rather than requires
  VPN apps

  Parental-control providers “may also use” NEVPNManager. A permission conditioned on being a parental-control app, not a duty owed to a child.

• 5.5 Permits rather than requires
  Mobile device management

  Parental-control companies are one of the limited categories allowed to offer MDM. Eligibility, not a child-triggered duty.

Out entirely, by number

Apple's five guideline sections, and every guideline in each that places no child-triggered duty on a developer.

Where the inventory came from

Apple App Store Review Guidelines, and Apple’s “Design safe and age-appropriate experiences” developer page for the Kids Category requirements that are not in the Guidelines text itself. Guideline numbers are Apple’s and are cited verbatim; where Apple states several duties in one un-numbered block, Keel appends a slug after a slash rather than inventing an Apple designator that does not exist.

Think one of these belongs in scope? That is the point of publishing it, so tell us which line. The full framework is at Apple App Store Kids Category.