Note: The original question in iTunes Connect regarding exemptions has since been changed to reflect recent changes made to their FAQ as follows:
Does your app meet any of the following: (a) Qualifies for one or more exemptions provided under category 5 part 2, (b) Use of encryption is limited to encryption within the operating system (iOS or macOS), (c) Only makes call(s) over HTTPS, (d) App is made available only in the U.S. and/or Canada.
TL;DR - In short, the answer to my original question per Apple Export Compliance is yes, "(under option d), encryption apps are now exempt from Export Regulations if sold in the U.S. and Canada app stores exclusively."
I have an iOS app built and ready to ship which allows the user to perform symmetric encryption using arbitrary length keys (i.e. > 56 bits). I've been reading up on US export regulations and am looking to extend my research here as well.
Does your app qualify for any of the exemptions provided in Category 5, Part 2 of the U.S. Export Administration Regulations?
Make sure that your app meets the criteria of the exemption listed here. You are responsible for the proper classification of your product. Incorrectly classifying your app may lead to you being in violation of U.S. export laws and could make you subject to penalties, including your app being removed from the App Store. Read the FAQ thoroughly before answering the questions.
You can select Yes for question #2 if the encryption of your app is:
- (a) Specially designed for medical end-use
- (b) Limited to intellectual property and copyright protection
- (c) Limited to authentication, digital signature, or the decryption of data or files
- (d) Specially designed and limited for banking use or "money transactions"; or
- (e) Limited to "fixed" data compression or coding techniques
You can also select Yes if your app meets the descriptions provided in Note 4 for Category 5, Part 2 of the U.S. Export Administration Regulations.
I should also point out that it's quite possible (and perhaps easy) to VPN into the US to download an app only being sold within the US and I guess this is where my main question lies - is this considered "exporting" and thus subject to US Export regulations as well?