Keeping your data from Apple is harder than expected

If I enable some personal assistant at some point in time, I absolutely do expect it to start with no memory.

The idea that there is this demand to fully disable it is bizarre to me.

And if you have malware that can access the entire file system then reading a Siri search index is the least of your troubles.

Everything is local only, except:

- when opted in to send diagnostics and performance analytics (to Apple for first party apps and OS, to app developers for third party apps):

> None of the collected information identifies you personally. Personal data is not logged at all, is subject to privacy preserving techniques such as differential privacy, or is removed from any reports before they’re sent to Apple.

> If you agree to send Analytics information to Apple from multiple devices that use the same iCloud account, we may correlate some usage data about Apple apps across those devices by syncing using end-to-end encryption. We do this in a manner that does not identify you to Apple.

- when searching for or suggesting information that's on the web, but none of it is ever linked to the user in any way:

> When you use Siri Suggestions, Look Up and Visual Look Up, when you type in Search, Safari search and #images search in Messages, or when you invoke Spotlight, limited information will be sent to Apple to provide up-to-date suggestions. Any information sent to Apple does not identify you, and is associated with a 15-minute random, rotating, device-generated identifier. This information may include location, topics of interest (for example, cooking or football), your search queries, including visual search queries, contextual information related to your search queries, suggestions you have selected, apps you use, and related device usage data. This information does not include search results that show files or content on your device. If you subscribe to music or video subscription services, the names of these services and the type of subscription may be sent to Apple. Your account name, number and password will not be sent to Apple.

> This information is used to process your request and provide more relevant suggestions and search results, and is not linked to your Apple ID, email address or other data Apple may have from your use of other Apple services.

> Aggregated information may be used to improve other Apple products and services. Common search queries may be shared with a web search engine to improve search results.

(emphasis mine)

One could argue that there's enough bits of data to deanonymise after the fact, but differential privacy should prevent that to a large extent.

There are also toggles to disable all of that, with possible improvements to usability:

- Some onboarding opt-in/out questions could definitely be improved (e.g the "Ask Siri" onboarding question should either cover all of Siri-the-voice-assistant, Siri-but-actually-Spotlight and Siri-the-suggestion-assistant-that-hints-at-actions-based-on-content-and-behaviour, or be split in three).

- Some grand-master "disallow the OS to see ANYTHING" switch seems to be requested by the most ardent "privacy minded" crowd. I'd argue that at this stage it's more about "privacy paranoid" and/or "security minded" (which I can very much be sympathetic to), because it's not a matter of privacy here since none of the above is privacy challenging: Apple itself does not see anyone's data, and the few search queries it can is entirely unlinked to anyone's id. But then again if you don't trust the locally-processing OS made by Apple (which is going to have access to data anyway because it handles the filesystem and app processes) then I have a surprise: the CPU made by Apple is seeing your data as well.

That doesn't sound like anyone's definition of privacy outside of Apple. Are you positive you think this defintion isn't twisted ?

Apple provides a setting to disable Siri. It does not function as users expect. Either remove the setting and state that users are forced to use Siri, or improve the usability.

> Users want to be able to search for apps, contacts, mail etc which is why it’s a standard feature of every operating system.

Typically an optional feature with one setting to disable it, e.g. people have long disabled Windows Indexing to improve performance and battery life. Or to use a 3rd-party search tool. Why was Siri ("AI") conflated with Spotlight (search) on iOS?

> If you have malware that can access the entire file system then reading a Siri search index is the least of your troubles.

With malware that can access the entire file system, we don't want to provide a gift-wrapped search and user behavior index that has been quietly collected by Apple. Let malware do its own CPU-intensive rummaging through each app, increasing the odds of detection.