WWDC 2026: Five Compliance Changes to Watch Behind the AI Headlines
5 Jun 2026 · 10 min read · Erik van Kammen
Apple's Worldwide Developers Conference runs from June 8 to 12, 2026, with the keynote on Monday, June 8 at 10:00 a.m. Pacific. Most of the coverage will be about the Siri revamp and Apple Intelligence across iOS 27, iPadOS 27, macOS 27 and the rest of the "27" lineup. But underneath the AI headlines there is a quieter story that matters more to your release pipeline, and that is compliance. Apple is shipping software into a 2026 regulatory environment shaped by US state age-verification laws, the EU's Digital Services Act and Digital Markets Act, the European Accessibility Act, and a privacy-manifest regime that grows every year. This preview walks through the five compliance areas worth watching at WWDC 2026, and what you can already audit today, before the first iOS 27 beta lands.
Why WWDC is a compliance event, not just a feature showcase
For most developers, WWDC is about new APIs and UI frameworks. But every recent release has also carried a payload of new obligations. iOS 17 brought privacy manifests, iOS 18 expanded the required-reason APIs, and iOS 26 introduced the Declared Age Range API along with much more aggressive Safari fingerprinting protections.
The pattern is pretty consistent. Apple does not build privacy and compliance features in a vacuum. It builds them in response to regulators. So the most reliable way to guess what WWDC 2026 means for your app is to look at the legal pressure Apple is under right now, and assume iOS 27 hands developers the tools, and the requirements, to deal with it.
One note on timing. This piece was written just before the June 8 keynote. Apple has since unveiled iOS 27 at WWDC, now in developer and public beta ahead of its general release this fall, and the compliance areas flagged below are the ones that landed: age assurance, privacy, AI data governance, and App Store policy. For what Apple actually shipped, see our recaps on the App Store changes, iOS 27 age assurance, and Foundation Models routing to Claude and Gemini.
Age assurance and the App Store Accountability Acts
This is the single biggest compliance theme heading into the conference.
As of mid-2026, Louisiana, Texas and Utah have each enacted an App Store Accountability Act. They share a common core: apps need accurate age ratings, verifiable parental consent for minors, and age verification handled at the platform level rather than with a homemade age gate. Texas's law survived a Supreme Court challenge in July 2026 and is in effect; Louisiana and Utah have both since pushed their compliance dates back a year. California took a different approach with its Digital Age Assurance Act (AB 1043), which relays a device-level age signal to apps rather than gating downloads at the store, effective January 1, 2027.
Apple's answer so far is the Declared Age Range API, available on iOS 26, iPadOS 26 and macOS 26 or later. Instead of asking a user for an exact birthdate, your app can request a parent-verified age range, for example 13 to 15, 16 to 17, or 18 and over. Parents confirm the range through system-level Screen Time controls.
A few things are worth watching at WWDC 2026 here. The first is mandatory adoption. Right now the Declared Age Range API is optional, but the California law's logic, that apps cannot keep using their own verification methods once a platform API exists, points toward Apple making age-range checks a hard requirement for apps in sensitive categories. The second is finer granularity, meaning more precise ranges or a stronger assurance signal that satisfies more of the state statutes at once. The third is change-notification tooling, since California asks for at least 30 days' notice before significant changes to data collection, in-app purchases, age ratings or consent flows, and it would not be surprising to see App Store Connect formalize that.
| Requirement | Where it comes from | What it means for you |
|---|---|---|
| Verifiable parental consent | LA, TX, UT statutes | A checkbox age gate no longer counts. You need credit-card, government-ID or verified-adult confirmation. |
| Accurate age ratings | LA, TX, UT statutes | Ratings have to reflect user-generated content and in-app purchases, not just the nominal content. |
| 30-day change notice | California (Digital Age Assurance Act) | Tell the store before you change data collection, purchases, ratings or consent flows. |
| Verification-data handling | LA, TX, UT statutes | Your privacy policy names the vendor, states the retention period (usually 30 to 90 days) and the deletion timeline. |
If you ship anything with social features, user-generated content, or age-sensitive material, this is your first audit item before iOS 27.
Privacy manifests and required-reason APIs
Privacy manifests, the PrivacyInfo.xcprivacy files, have expanded every single year since Apple started enforcing them in May 2024. Each release adds API categories that count as "required reason" and tightens what your third-party SDKs have to declare.
iOS 26 kept that going. Safari now blocks access to common fingerprinting signals by default, things like screen dimensions, CPU core counts, Web Audio readback and 2D Canvas details, and it strips tracking parameters such as utm_source, gclid, fbclid and msclkid from links opened in Mail, Messages and Private Browsing.
For WWDC 2026, the things to watch are fairly predictable. Expect new required-reason API categories, since every iOS release so far has added to the list of fingerprinting-prone APIs that need a declared reason code. Expect tighter SDK enforcement too, because Apple already publishes a list of commonly used SDKs that are expected to ship their own manifests, and that list tends to grow while enforcement gets stricter. And expect a smarter privacy report, where the Xcode tool that pulls together your app and SDK manifests starts surfacing more mismatches on its own.
The takeaway has not changed, it has just become more urgent. Your privacy manifest has to match what your binary actually does, across every embedded SDK. If that audit is not already part of your CI, WWDC 2026 is a good deadline to fix that. Our walkthrough on auditing your iOS privacy manifest covers the step-by-step.
Anti-steering, external links and the DMA
Apple's App Review Guidelines were already updated earlier in 2026 to comply with a US court decision about buttons, external links and other calls to action, starting with the United States storefront. At the same time, the EU's Digital Markets Act forces Apple to allow alternative app distribution, external payment links and notarized apps from outside the App Store.
So at WWDC 2026, keep an eye out for a cleaner external-link entitlement, where Apple finally converges its US and EU "linking out" rules into one model instead of patching it storefront by storefront. Watch for notarization changes too, since the pipeline for EU alternative distribution is still maturing and tends to get tooling and policy tweaks. And watch for region-aware builds, meaning proper App Store Connect support for apps that already behave differently per region, rather than fragile runtime checks.
The risk here is easy to underestimate. Anti-steering rules differ by jurisdiction, so the same binary can be perfectly compliant in the EU and rejected somewhere else. Testing compliance per region is slowly becoming table stakes.
Apple Intelligence, on-device AI and the EU AI Act
WWDC 2026 is expected to be dominated by a revamped Siri and a wave of Apple Intelligence features. The compliance side of that is easy to miss, but it is real.
iOS 26 introduced the Foundation Models API, which lets developers run text and image inference on the device without sending data to Apple's servers. That on-device default is itself a compliance feature, because it shrinks the data-processing surface that GDPR, the EU AI Act and US state privacy laws all care about.
A few things are worth watching. If your app uses generative AI, expect tighter rules on disclosing AI-generated content and on what user data feeds a model, because the EU AI Act regulates exactly this kind of transparency. Apple may also add an on-device versus server signal, a privacy label or manifest entry that distinguishes on-device inference from cloud processing. And generative features run straight into the age-assurance rules from the first section, so age-appropriate AI is its own concern.
If you are adding AI features, treat data provenance and transparency as compliance requirements, not just product polish.
Accessibility after the European Accessibility Act
The European Accessibility Act has applied since June 28, 2025, and 2026 is the year enforcement actually arrives. A lot of consumer apps now fall inside its scope, including e-commerce, banking, ticketing and e-books, and they are expected to meet accessibility standards aligned with WCAG.
Apple has a long history of using WWDC to expand its accessibility APIs, and the EAA gives developers a hard reason to adopt them. Look for new accessibility APIs that make WCAG-aligned behavior the default instead of an opt-in, better audit tooling in Xcode that flags issues before submission, and Apple Intelligence accessibility features like live captions, audio descriptions and a smarter VoiceOver that happen to double as compliance wins.
For apps serving EU users, accessibility has stopped being a nice-to-have. It is a legal obligation with a 2025 effective date and 2026 enforcement behind it.
What to audit before the first iOS 27 beta
You do not need to wait for the keynote. The regulations driving all of this are already live. Here is a short pre-WWDC checklist:
- Age assurance. If your app has user-generated content or age-sensitive material, check that your ratings are accurate and look at adopting the Declared Age Range API.
- Privacy manifest. Re-run your PrivacyInfo.xcprivacy audit across the app and every SDK, and make it a CI gate.
- SDK inventory. List every third-party SDK, its version, its manifest status and any known CVEs.
- Anti-steering. Map which external-link and payment behaviors your app uses, and in which regions.
- AI data flows. Write down what data your AI features process and where, on-device or server.
- Accessibility. Run a WCAG-aligned audit if you serve users in the EU.
Keeping all of that current by hand, release after release, does not really scale. This is where a tool like AppCompliance helps. It continuously scans your app binary and the SDKs inside it, checking privacy manifests, known vulnerabilities, store-policy rules and EU regulatory requirements, and it flags problems before you submit. That turns the WWDC scramble into a standing CI gate, so each new iOS requirement is something you have already handled.
FAQ
When is WWDC 2026 and when is the keynote?
WWDC 2026 runs from June 8 to 12, 2026. The keynote is on Monday, June 8 at 10:00 a.m. Pacific, which is 1:00 p.m. Eastern. It is a free, hybrid online and in-person event.
What operating systems will Apple announce at WWDC 2026?
Apple is expected to show iOS 27, iPadOS 27, macOS 27, watchOS 27, tvOS 27 and visionOS 27, with a big focus on a revamped Siri and Apple Intelligence. Developer betas usually arrive right after the keynote, and a public beta tends to follow around July.
Will WWDC 2026 introduce new compliance requirements for developers?
Almost certainly. Recent releases have each added new obligations, including privacy manifests, required-reason APIs and the Declared Age Range API. Given the 2026 regulatory backdrop, with US age-verification laws, the EU DSA and DMA, and the European Accessibility Act, it is reasonable to expect iOS 27 to extend age assurance, privacy disclosures and accessibility requirements.
What is the Declared Age Range API?
It is an Apple API, available from iOS 26, that lets your app request a parent-verified age range, such as 13 to 15, 16 to 17, or 18 and over, instead of an exact birthdate. Parents confirm the range through system-level controls. It exists to help developers comply with the US App Store Accountability Acts.
Do I need to change anything before the WWDC 2026 keynote?
Yes. The regulations behind these changes are already in force. Audit your age ratings, privacy manifest, SDK inventory, anti-steering behavior, AI data flows and accessibility now, rather than waiting for the iOS 27 beta.
How does this affect Android and Google Play?
A lot of the same drivers, age-verification laws, the EU DSA and accessibility, apply to Google Play as well, and Google has its own parallel requirements on Google Play. A cross-platform compliance audit covers both at once.
WWDC 2026 was billed as an AI event, but for app teams the lasting story is compliance. Every "27" release ships into a tighter regulatory environment, and the developers who treat App Store compliance as a continuous, automated check rather than a per-release fire drill are the ones who keep shipping on time. For what Apple actually announced, read our recaps on the App Store overhaul, iOS 27 age-assurance duties, and multi-provider Foundation Models.