How to market a VPN app: the store rules to know first

VPN app rules side by side

From Apple’s App Review Guidelines (5.4) and Google Play’s VpnService policy help article.

Who may publish a VPN app

Apple says apps offering VPN services must use the NEVPNManager API and may only be offered by developers enrolled as an organization, so an individual developer account cannot ship one. Apps that break the guideline are removed from the App Store, blocked from installing via alternative distribution, and the developer may be removed from the Apple Developer Program. On Google Play, only apps that use the VpnService and have VPN as their core functionality can create a secure device-level tunnel to a remote server, with exceptions such as parental control, device security, network tools, browsers and carrier apps. Every app that uses VpnService completes a declaration in Play Console, and Google notes that picking a category that does not match the app’s core purpose can lead to rejection.

The disclosure users see before they pay

Apple requires a clear declaration of what user data will be collected and how it will be used, on an app screen, before any user action to purchase or otherwise use the service. Google Play requires a prominent disclosure inside the app, shown in normal use rather than in a menu, that describes the data accessed through the VpnService API, explains how it is used or shared, and requires an affirmative action such as a tap or a checkbox. It cannot live only in the privacy policy or the store description, and it must be separate from other data disclosures. Since Apple places it before any purchase, it belongs in your onboarding ahead of the paywall; the paywall rules themselves are in how to market a subscription app.

Privacy claims have to match the rules

Apple says apps offering VPN services may not sell, use or disclose to third parties any data for any purpose, and must commit to this in their privacy policy. Google Play says VpnService may not be used to collect personal and sensitive data without prominent disclosure and consent, or to redirect or manipulate traffic from other apps for monetization, such as routing ad traffic through another country, and that apps must encrypt data from the device to the VPN tunnel endpoint. Whatever you say about privacy in ads, on your website and in screenshots has to be something your privacy policy and your app actually do. Google warns that deceptive or undeclared use of these APIs can lead to suspension of the app or termination of the developer account.

Countries and licences

Apple says VPN apps must not violate local laws, and if you make your app available in a territory that requires a VPN licence, you must provide the licence information in the App Review Notes field. So the list of countries you market in is a store decision as much as a marketing one: check the storefronts you select against the licences you hold before you run campaigns there. On Google Play, if you change how your app uses the VpnService API, you submit the declaration again with updated information.

Where Censuus fits

Within those rules the usual store tools apply: see the ASO checklist, how to promote an iOS app and how to promote an app on Google Play. Censuus ranks apps by the visits they draw and by sponsorship on the web, and utility apps have their own category at utilities. Adding your app is free on the List my app form, and sponsorship raises placement and adds a followed link to your website, see the sponsor page. We do not promise downloads or store rankings, and this guide is not legal advice.

Guides for app developers

• How to market a subscription app: what the stores require of your offer
• How to market an app: a stage-by-stage plan
• How to promote an iOS app with App Store Connect’s own tools
• How to promote an app on Google Play with Play Console’s own tools
• App store optimization checklist: what Apple and Google actually say
• Common App Store rejection reasons and how to avoid them