# Content rating is set for app stores

- **Pattern:** `ab-001948` (`mobile-store-readiness.store-compliance.content-rating-set`)
- **Severity:** high
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-001948
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-001948)

## Why it matters

Both app stores require content ratings completed through the IARC system (apple-age-ratings, google-play-content-rating) before an app can go live. Without a rating, submissions are blocked at the final publish step regardless of how polished the binary is. A rating also serves a compliance function: apps that collect data from users under 13 must declare this through the rating questionnaire, which triggers COPPA compliance requirements. Incorrectly self-rating an app lower than its actual content (e.g., rating a 17+ app as 4+) constitutes misrepresentation and can result in removal and developer account termination — a disproportionate consequence for what appears to be a configuration step.

## Severity rationale

High because missing content ratings block the final publish step on both stores regardless of binary quality, and IARC misclassification exposes the developer account to termination for misrepresentation.

## Remediation

Complete the IARC content rating questionnaire before submission. For EAS-managed submissions, the `eas submit` flow prompts for this interactively. For manual submissions, initiate the questionnaire in App Store Connect or Google Play Console before uploading the binary.

```json
// eas.json — configure submit flow to include rating
{
  "submit": {
    "production": {
      "ios": {
        "appleId": "you@example.com",
        "ascAppId": "1234567890"
      },
      "android": {
        "serviceAccountKeyPath": "./google-play-key.json",
        "track": "production"
      }
    }
  }
}
```

Allocate 10–15 minutes for the questionnaire. Answer honestly — the system asks about violence, sexual content, profanity, controlled substances, and in-app purchases. The resulting IARC certificate propagates automatically across Apple and Google stores.

## Detection

- **ID:** `content-rating-set`
- **Severity:** `high`
- **What to look for:** Check `app.json` for `ios.requiresFullScreen` or rating-related fields, and look for content rating metadata in Android config or eas.json. Count all content-rating-related configuration fields found. For App Store, check if IARC content rating has been completed (should have a rating ID). For Play Store, check if content rating questionnaire has been filled. Look in eas.json for `submit.ios.ascAppIdApple` and content rating references.
- **Pass criteria:** Content rating is set or will be completed during submission. For Expo EAS, submit configuration includes content rating steps or an `ascAppIdApple` reference. For manual submission, at least 1 rating-related configuration field exists in app.json or eas.json.
- **Fail criteria:** Content rating is missing or not planned, submission flow does not include content rating steps. No rating configuration found in any config file.
- **Skip (N/A) when:** Never — both stores require content rating before publication.
- **Detail on fail:** `"No content rating configuration found in app.json or eas.json"` or `"eas.json submit configuration does not include content rating step"`
- **Remediation:** App stores require content ratings before publication. Complete:
  1. **For App Store (via IARC):**
     - Go to https://www.globalratingcoalition.org/
     - Answer the IARC content rating questionnaire
     - Receive a rating ID
     - In app.json: `"ios": { "ratingId": "..." }` (if using EAS)
  2. **For Google Play Store:**
     - Complete the Play Console content rating questionnaire when submitting
     - Or set up in advance at https://play.google.com/console
  3. Rating typically takes a few minutes to complete:
     - Answer about content types (violence, language, mature themes, etc.)
     - Receive a rating (4+, 9+, 12+, 17+)
  4. If using EAS Build with submit:
     ```bash
     eas build --platform ios --auto-submit  # Prompts for rating during submit
     ```

## External references

- external iarc-rating — https://www.globalratingcoalition.org/
- external apple-age-ratings — https://developer.apple.com/help/app-store-connect/manage-app-information/set-an-app-age-rating
- external google-play-content-rating — https://support.google.com/googleplay/android-developer/answer/188189

Taxons: regulatory-conformance

HTML version: https://auditbuffet.com/patterns/ab-001948