Apple Intelligence and Data Privacy: How Apple Protects Your Data

An AI that summarizes emails, rewrites texts, and knows the calendar inevitably has to work with personal information. Apple addresses the privacy issue with a tiered system: as much as possible directly on the device, the rest via a custom-built and auditable cloud. With iOS 27, however, this foundation shifts significantly - even leading to an AI model that, for the first time, runs on third-party hardware.

Privacy has been Apple's central selling point for years, and with Apple Intelligence, the company continues this approach in artificial intelligence. The basic idea: personal data should ideally not leave the device, and if it does, then only under verifiable conditions. For the features to work at all, Apple Intelligence must first be set up and activated in the settings. How the system divides the processing, which security mechanisms are behind it, and what changes with iOS 27 can be understood step by step – in addition, there's a built-in tool that allows users to verify much of it themselves.

The basic principle: first the device, then the cloud

The most important component of Apple Intelligence is processing directly on the device. A local language model runs on the Apple Silicon chip and handles the majority of requests without any data leaving the iPhone, iPad, or Mac. Summaries of emails, messages, and notifications, for example, are generated entirely locally.

Apple clearly states its goal: No one should be able to access the processed data – not even Apple itself. In everyday use, this means that many AI functions even work offline. Only when a task requires more computing power than the device can provide does the second layer come into play.

Private Cloud Compute: Secure cloud for complex requests

Private Cloud Compute is Apple's answer to the question of how to use larger, server-based models without sacrificing privacy. The servers run on Apple Silicon and are built according to the same principles as the devices themselves.

How the request process works

When a request is submitted, Apple Intelligence first checks whether it can be processed locally. If not, it is forwarded to Private Cloud Compute. There, only the data necessary for the specific request is processed – no other information. After processing, the data is deleted. It is not permanently stored and is not accessible to Apple.

The security mechanisms of the servers

To ensure that this promise is technically secure, several layers of protection work together:

Secure Enclave: protects the central encryption keys on the server – just as it does on the iPhone.
Secure boot: ensures that the operating system running on the server is signed and verified.
Trusted Execution Monitor: ensures that only signed and verified code is executed.
Attestation: The device verifies the identity and configuration of the server before any data is sent.

Verifiable, not just promised

The key difference to other cloud AI services lies in its verifiability. Apple publishes the software running on its private cloud compute servers and logs it in a tamper-proof, publicly accessible directory. Independent security researchers can examine this code, and a device only communicates with a server if its software has been publicly deposited. Apple pays rewards for discovered vulnerabilities as part of its bug bounty program. This ensures that the data privacy promise isn't just a claim, but can be externally verified.

What changes to the architecture in iOS 27

As stable as this basic principle sounds, Apple has recently significantly restructured the underlying foundation. With iOS 26, the company opened up the local language model to app developers via the so-called Foundation Models framework, allowing third-party apps to offer AI functions directly on the device – free of charge, sometimes offline, and without data leakage. iOS 27 marks a bigger step: the third generation of Apple Foundation Models – and for the first time, a model that no longer relies on Apple hardware.

Five models – and one runs on Google

Instead of a single on-device model and a server model, the system now consists of five specialized models distributed across three levels. The detailed structure of Apple's third-generation Foundation Models can be seen in their distribution:

Model	Where it's running	Task
AFM 3 Core	on the device	Basic model, approximately 3 billion parameters
AFM 3 Core Advanced	on the device	strongest on-device model, 20 billion parameters, multimodal
AFM 3 Cloud	Apple Silicon Server	Workhorse for speed and efficiency
ADM 3 Cloud (Image)	Apple Silicon Server	Image generation, among other things, powers Image Playground.
AFM 3 Cloud Pro	Nvidia GPUs on Google Cloud	most demanding tasks such as complex reasoning

Two models run directly on the device, two on Apple's own servers – and the most powerful, AFM 3 Cloud Pro, on Nvidia GPUs in the Google Cloud. With this, Apple breaks for the first time with the principle of running AI exclusively on its own hardware. This was made possible because, according to Apple, it has extended its private cloud compute architecture to third-party infrastructure without compromising its security mechanisms.

Built on Gemini, but not Gemini

The backbone of these new models comes from Google: The new Siri generation and other Apple intelligence features are based on Gemini technology. However, Apple explicitly distinguishes this from a simple "Gemini on the iPhone." The models were specifically rebuilt for Apple on the Gemini platform, retrained with Apple's own data and security protocols, and are completely separate from Google's own assistant. Expert analyses indicate that four of the five models are adapted Gemini versions running on Apple Silicon, while the most powerful model remains fundamentally Google's model on Google servers – without access to Google's web search.

What this means for your data

For data protection purposes, the location of the data processing is of primary importance:

On the device (two models): The data never leaves the iPhone – the highest possible protection.
In Apple's own Private Cloud Compute (two models): Processing takes place on Apple Silicon servers, designed so that neither Apple nor Google can withhold or view data – and this can be independently verified.
On Google servers (one model): The most powerful model runs on Nvidia GPUs in servers reserved exclusively for Apple. Despite using third-party hardware, the same PCC principles are intended to apply – stateless processing, no privileged access, non-addressability of individual users, and verifiable transparency. This is implemented using, among other things, Nvidia Confidential Computing, Intel TDX processors, and Google's Titan chip; the details are shown in the PCC architecture extended to Google Cloud.

However, this is also where the limits of what can be independently verified today lie. Security researchers can trace the protection mechanisms on the device itself and in Apple's own cloud; the version on Google servers is comparatively new and less tested. This doesn't contradict Apple's assurances, but it does call for sober caution – new architectures can contain vulnerabilities that simply haven't been discovered yet.

More control over saved histories

iOS 27 also offers more granular control over stored data. History from the new Siri generation can be automatically deleted after a specified period – such as 30 days or one year – kept permanently, or synced between devices via iCloud. The fundamental separation of data between the device and the cloud remains unchanged, and Apple continues to consider data privacy non-negotiable.

The third level: ChatGPT integration

In addition to its own system - regardless of whether it's running on the device, in Apple's cloud, or on Google servers reserved for Apple - Apple Intelligence also integrates ChatGPT from OpenAI. This is fundamentally different: an optional layer where a request is actually sent to an external service and is no longer covered by the guarantees of private cloud computing. It's therefore worthwhile to understand the difference.

The ChatGPT extension is disabled by default and must first be actively enabled. Before each transmission, you are asked whether a request should actually be sent to ChatGPT. Users of the extension without an OpenAI account benefit from two assurances: their IP address is masked from OpenAI, and OpenAI is prohibited from storing the requests or using them to train its models. Furthermore, no data is linked to the Apple account.

However, once you log in with an OpenAI account, OpenAI's privacy policy applies – conversations can then be saved in the account and used depending on the settings. Crucially, once a request is sent to ChatGPT, the agreements in place on the device and in Private Cloud Compute no longer apply; instead, OpenAI's privacy practices take over.

See for yourself: the Apple Intelligence Report

How often requests actually end up in the cloud can be checked directly using a built-in tool. The Apple Intelligence report logs which requests were sent to Private Cloud Compute.

Open the settings and select "Privacy & Security" (on a Mac via System Preferences).
Tap on "Apple Intelligence Report".
Choose the time period – the last 15 minutes or the last seven days. The log can also be deactivated via "Off".
Export the report as a file if needed.

The exported file is called Apple_Intelligence_Report.json and can be opened with a text viewer. The privateCloudComputeRequests section lists the tasks for which the device accessed the servers. This includes requests from watchOS and - if the ChatGPT extension is active - requests sent to ChatGPT. It's important to note that for many users, the report will be largely empty because the majority of requests are processed locally. Apple only records basic technical data about the requests themselves, such as their approximate size and duration, but not their content. Users who don't want to allow certain AI functions at all can further restrict them via Screen Time.

Apple Intelligence, the EU and data protection

For users in Germany, Apple Intelligence, including the described architecture, has been available since iOS 18.4. The tiered model - local processing, no permanent storage, no link to the Apple account, and an independently verifiable cloud - aligns well in its basic principles with European principles such as data minimization and data protection by design. However, a general assessment of legal compliance remains a matter of individual circumstances, especially in professional settings.

The situation is different with the latest version: The new Siri generation introduced with iOS 27 is initially unavailable on iPhones and iPads in the EU because it conflicts with the Digital Markets Act. However, it can be used on Macs and Apple Vision Pro in the EU if a supported language is selected. Switzerland is not affected by this restriction: As it is not part of the EU, the Digital Markets Act does not apply there, and the new Siri generation is available as in the rest of the world.

Data protection as architecture, not as a promise

Apple Intelligence demonstrates that modern AI and data privacy can be technically combined: The majority of processing remains on the device, while more complex requests are routed through a cloud whose commitments can be independently verified. With iOS 27, this foundation becomes more ambitious and, at the same time, more complex – the most demanding tasks are handled by a Gemini-based model running on third-party hardware, for which Apple offers the same guarantees, but which has so far been subject to less extensive independent auditing. Users should also be wary of the optional ChatGPT layer, because as soon as a request is routed there, OpenAI's rules apply instead of Apple's guarantees. The Apple Intelligence report makes these boundaries clear and allows everyone to track for themselves which data leaves the device.

The best products for you: Our Amazon Storefront offers a wide selection of accessories, including for HomeKit. (Image: Apple)

Frequently Asked Questions: Apple Intelligence and Data Privacy

How privacy-friendly is Apple Intelligence?

The majority of processing takes place locally on the device. More complex requests are sent to Private Cloud Compute, where data is not stored and is inaccessible to Apple – and this promise is independently verifiable.

Is my data stored with Apple Intelligence?

No. Local requests do not leave the device, and with Private Cloud Compute, only the data necessary for the request is processed temporarily and then deleted.

What is Private Cloud Compute?

Apple's server-based system handles requests that are too computationally intensive for the device. It runs on servers with Secure Enclave, secure boot, verified code, and attestation – without persistent data storage.

Is my data with Google because Siri AI is based on Gemini?

Not so simple. While the new Siri generation is based on Gemini models, four of the five models run on the device itself or in Apple's own private cloud, Compute, where neither Apple nor Google can access the data. Only the most powerful model runs on Google servers reserved for Apple – and according to Apple, the same security mechanisms apply there as well.

How secure is the ChatGPT integration in Apple Intelligence?

ChatGPT is a separate layer that is disabled by default. Without an OpenAI account, the IP address is masked and nothing is stored or trained; with an account, OpenAI's own rules apply. Apple's warranties do not apply here.

How can I see which AI requests have left my iPhone?

Go to Settings → Privacy & Security → Apple Intelligence Report. There you can create a log (15 minutes or 7 days) and export it as a file.

Can I disable Apple Intelligence?

Yes, in iOS 26 – a central switch in the "Apple Intelligence & Siri" menu disables all AI functions and removes the local models from the device. This central switch is missing in the iOS 27 betas; there, only individual functions can be disabled (such as Siri itself, ChatGPT, or summaries) or restricted via Screen Time. It remains to be seen whether the complete disable switch will return in the final version.

Make Apfelpatient a preferred source One click – and you'll see us more often on Google

Was this article helpful?

YesNo