MacSouverain

FREN
Apple Intelligence

Apple Intelligence: What's Really Leaving Your Mac

Your Mac switched Apple Intelligence to ON without telling you. Three layers of processing, only one stays with you. And no one mentions the linked OpenAI account trap.

Apple Intelligence: What's Really Leaving Your Mac

Update of June 21, 2026. Since June 8, 2026, PCC no longer runs solely on Apple silicon: for the heaviest queries (agentic, complex reasoning), Apple switches to Google Cloud hardware, NVIDIA GPU, Intel CPU, and Titan chip. Apple swears that the five guarantees hold, that it keeps software control, and that Google sees nothing in the clear. Perhaps. But the “all stays with Apple” argument for the general public has just fallen: it’s now also Google iron under Apple guarantees.

You’ve updated your Mac. You’ve accepted the TOS without reading (like everyone else). A few weeks later, you realize that the “Apple Intelligence” toggle is on, when you had turned it off. It’s not a hallucination: since macOS 15.3 released on January 27, 2025, Apple Intelligence has switched from opt-in to opt-out. And some users who had turned it off found it turned back on after 15.3.1, a bug confirmed by MacRumors and 9to5Mac, inconsistent from one device to another. Not a systematic rule, but frequent enough to check after each update.

It’s time to understand what happens when you click “Summarize” on a long email. Because between your Neural Engine and a California data center, there are three processing layers. Only one stays really on your machine.

Why this question is not harmless

Apple sells Apple Intelligence as an IA “privacy-first”. The slogan is everywhere on the product site: aware of your personal information without collecting your personal information. It’s technically true for part of the perimeter, and technically false for the rest.

A generative AI, by construction, needs calculation. When the model running on your Mac isn’t enough, the request goes out. Either to Apple servers or those of OpenAI. In both cases, your text leaves your machine. The question isn’t whether it goes out. It’s where, under what guarantees, and how Apple informs you (spoiler: badly).

Layer 1: the local model, what stays really on your machine

On Apple Silicon (M1 and later), Apple runs a foundation model of about 3.18 billion parameters. Quantified 2 bits per weight via Quantization-Aware-Training, memory footprint of about 1 Go, shared KV-cache that saves 37.5% RAM. The calculation happens on the Neural Engine, the GPU, and the CPU of the chip, never on a server.

In concrete terms, here’s what stays 100% local:

  • Writing Tools short version: Proofread, Rewrite, Summarize on short texts
  • Smart Reply in Mail and Messages
  • Notification summaries and Priority Notifications
  • Short Mail summaries in the inbox list
  • Genmoji (generation of custom emoji)
  • Image Playground (Animation, Illustration, Sketch)
  • Image Wand in Notes
  • Basic Siri (understanding, type-to-Siri)
  • Clean Up Photos

For these uses, your text does not leave the Apple Silicon. No logs, no server, no content telemetry. That’s the honest perimeter of Apple’s promise, and it’s real.

The problem starts when you ask for something else. Long summary of an 80-message Mail thread, generated text composition, multi-step Siri reasoning: your Mac knows it can’t handle the load. It switches. And Apple doesn’t display any indicator to signal it.

Layer 2: Private Cloud Compute, the California enclave

This is Apple’s marketing strong point. PCC runs on custom-silicon Apple in their data centers, with five technical guarantees highlighted in the Security Research doc:

  1. Stateless computation: your text is used to respond, never stored after the request.
  2. Enforceable guarantees: the protections are technically applied, not contractually promised. An Apple admin can’t disable the mechanism.
  3. No privileged runtime access: no remote shell, no interactive debugging. Apple can’t extract your data, even voluntarily.
  4. Non-targetability: an attacker can’t route your request to a compromised specific node. Request diffusion to nodes is random and attested.
  5. Verifiable transparency: each production build published in a cryptographically append-only log, binary images available for external inspection for 90 days.

Apple pushed its PCC server code on GitHub, opened a research environment to external researchers, and put up a $1 million bug bounty. As of today, it’s the most auditable cloud IA stack on the market.

Now the nuances, because there are some.

Trail of Bits, in its June 14, 2024 analysis, points out a point that Apple marketing glosses over: “the data is decrypted on Apple’s server”. PCC is not homomorphic encryption (the tech that calculates a model on encrypted data without ever decrypting it). It’s a hardened enclave, signed, attested, but your text is indeed decrypted on the Apple side during the calculation. Security relies on the integrity of the enclave and the signing of the binaries, not on cryptographic magic. Apple is honest about this in the tech doc. The consumer slogan, however, leaves room for misunderstanding.

Second nuance, more uncomfortable. Matthew Green, cryptographer at Johns Hopkins, on Mastodon in June 2024: “Apple does not have explicit plans to announce when your data is going off-device for Private Compute, and you won’t opt into this or necessarily even be told it’s happening”. Translation: you don’t know if the summary of your mail stayed on your M2 or if it made a round trip to California. No visual indicator, no notification, no user-side journal. Apple’s transparency is cryptographically verifiable but visually invisible.

Layer 3: ChatGPT, the opt-in and its trap

ChatGPT is grafted onto Apple Intelligence since macOS 15.2. Turned off by default, activatable explicitly in Apple Intelligence & Siri → Extensions → ChatGPT. When you turn it on, Apple adds two protections over the standard OpenAI contract:

  • Your IP is masked by the Apple relay (verbatim Apple Legal: “your IP address is obscured from ChatGPT”). Approximate location passed, for legal compliance and anti-fraud.
  • No-logs and no-training on OpenAI’s side, provided you haven’t linked your OpenAI account. Apple Legal: OpenAI “must process your information solely for the purpose of fulfilling your request”, “must not store your information”, “must not use your information to improve or train its models”.

Read the conditional carefully. If you link any OpenAI account (free, Plus, Pro, Team) to retrieve your history or access GPT-5, you immediately opt out of Apple’s contract and fall back under OpenAI’s standard TOS. Logs, conversation history, potential training, all under US jurisdiction. Apple mentions this in the legal text, in small print, after three paragraphs. Most users link their account without realizing they’ve just turned off the protection that made them choose Apple.

Second detail. The “Confirm ChatGPT Requests” toggle is on by default: Siri asks for confirmation before sending the text. You can turn it off. But especially, if you start your voice request with “Ask ChatGPT…”, confirmation is bypassed. It’s a documented shortcut on Apple’s side, that circumvents the only visible safeguard of the device. Photos and files keep confirmation, they do, in all cases.

The four toggles to check

Four paths to know on Sequoia 15.x and Tahoe 26. The English titles are guaranteed (tested by Apple Support on US Macs), the French ones are the titles you’ll likely see, to be confirmed on your Mac.

1. The master Apple Intelligence System Settings → Apple Intelligence & Siri (toggle at the top of the panel). Default state since macOS 15.3: ON on compatible Macs. Documented cases of reactivation on 15.3.1 (bug, not design). Rare afterwards, but check after each update. Turn off if you want nothing, really nothing.

2. ChatGPT master System Settings → Apple Intelligence & Siri → Extensions → ChatGPT → Use ChatGPT. Default state: OFF. Activate only if you want it, and especially: don’t link your OpenAI account.

3. Confirm ChatGPT Requests System Settings → Apple Intelligence & Siri → Extensions → ChatGPT → Confirm ChatGPT Requests. Default state: ON. Leave it on. The confirmation friction is your only visual indicator that a request is going off your Mac.

4. Improve Siri & Dictation System Settings → Privacy & Security → Analytics & Improvements → Improve Siri & Dictation. Default state: OFF. Check that it stayed OFF. It decides if Apple stores audio snippets of your Siri interactions for human review. Random ID, hourly rotation, no Apple ID link, they insist. You choose to trust them or not.

Apple, Microsoft, Google: who does what

Five criteria that matter to someone wondering about sovereignty. Vendor by vendor verdict.

Apple Intelligence. Local by default, yes: 3B on-device model, explicit PCC switch for heavy queries. Public cryptographic attestation, yes: transparency log, dedicated research environment (VRE), server code published on GitHub. Cloud opt-in, half and half: implicit and invisible PCC, explicit and confirmed ChatGPT requests. Third-party LLM integrated, OpenAI ChatGPT, opt-in, OFF by default, no-logs as long as you don’t link your OpenAI account. Server jurisdiction, USA, Apple custom-silicon data centers.

Microsoft Copilot+/Recall. Local by default, partial: Recall makes its snapshots locally and never sends them to the cloud, Copilot general runs in Azure. Public attestation, no: local VBS encryption plus TPM, no opposing auditable server. Cloud opt-in, depends on the feature: Recall purely local, Copilot general cloud by design, the user doesn’t always distinguish which triggers what. Third-party LLM integrated, Azure OpenAI GPT-4, commercial integration without separate opt-in. Server jurisdiction, USA plus global Azure regions.

Google Gemini. Local by default, no: cloud Google by default, Gemini Nano local exists but remains limited to high-end Pixel devices. Public attestation, no. Cloud opt-in, the opposite: cloud by default, partial opt-out via Activity, and you lose features along the way. Third-party LLM integrated, none, Google’s stack locked down. Server jurisdiction, EEE/Switzerland via Google Ireland for EU accounts, rest of the world via Google LLC (USA).

A quick read: on this specific dossier, Apple does better. Recall version 2025 is solid locally but remains an attack vector on shared devices (Kevin Beaumont has documented it repeatedly). Gemini keeps a subset of chats for up to three years for human review, even when you turn off activity. Apple is the only one to publish its server code and pay $1 million to have it broken.

Apple spent $1 million to have its code broken. The others spent $1 million on TV spots. That doesn’t make PCC an E2EE. It makes it the least opaque cloud IA option on the market in 2026.

Mack’s verdict

Apple has built the most auditable cloud IA architecture on the mass market. That’s a fact. Trail of Bits, Matthew Green, and Schneier all recognize it, each in their own way, while pointing out what’s wrong.

What’s wrong is three UX decisions that betray a marketing intent superior to privacy intent: the opt-out by default since 15.3, the complete absence of a visual indicator when a request switches to PCC, and the silent OpenAI account link trap. None of these three points is a bug. They’re choices.

What you can reasonably do: turn off the master if you don’t need it, keep the ChatGPT confirmation toggle on if you use it, never link your OpenAI account, check Improve Siri & Dictation after each major update. That’s five minutes of settings, to be redone two or three times a year.

Also read: The cloud, it’s someone else’s computer, Privacy macOS: the settings to change immediately, and Convergence of digital freedoms.

Sources

Apple, primary sources

Independent analyses

Comparison with competing IAs