# Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12

arXiv: https://arxiv.org/abs/1709.02753 · HTML: https://mlsanity.com/paper/1709.02753/

## Key facts

- Cited by 43 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Sep 2017.

## Built on by (most cited first, 30 of 43)

- [Robust and Differentially Private Mean Estimation](https://mlsanity.com/paper/2102.09159/) (2021)
- [High Dimensional Differentially Private Stochastic Optimization with Heavy-tailed Data](https://mlsanity.com/paper/2107.11136/) (2021)
- [Generalized Linear Bandits with Local Differential Privacy](https://mlsanity.com/paper/2106.03365/) (2021)
- [Differentially private inference via noisy optimization](https://mlsanity.com/paper/2103.11003/) (2021)
- [DP-PCA: Statistically Optimal and Differentially Private PCA](https://mlsanity.com/paper/2205.13709/) (2022)
- [How unfair is private learning ?](https://mlsanity.com/paper/2206.03985/) (2022)
- [Faster Rates of Private Stochastic Convex Optimization](https://mlsanity.com/paper/2108.00331/) (2021)
- [Privately Publishable Per-instance Privacy](https://mlsanity.com/paper/2111.02281/) (2021)
- [Near Optimal Private and Robust Linear Regression](https://mlsanity.com/paper/2301.13273/) (2023)
- [Assessment of Differentially Private Synthetic Data for Utility and Fairness in End-to-End Machine Learning Pipelines for Tabular Data](https://mlsanity.com/paper/2310.19250/) (2023)
- [Optimal Locally Private Nonparametric Classification with Public Data](https://mlsanity.com/paper/2311.11369/) (2023)
- [An Analysis of the Deployment of Models Trained on Private Tabular Synthetic Data: Unexpected Surprises](https://mlsanity.com/paper/2106.10241/) (2021)
- [Mean Estimation Under Heterogeneous Privacy Demands](https://mlsanity.com/paper/2310.13137/) (2023)
- [The Fair Value of Data Under Heterogeneous Privacy Constraints in Federated Learning](https://mlsanity.com/paper/2301.13336/) (2023)
- [Algorithms with More Granular Differential Privacy Guarantees](https://mlsanity.com/paper/2209.04053/) (2022)
- [Improved Analysis of Sparse Linear Regression in Local Differential Privacy Model](https://mlsanity.com/paper/2310.07367/) (2023)
- [LIA: Privacy-Preserving Data Quality Evaluation in Federated Learning Using a Lazy Influence Approximation](https://mlsanity.com/paper/2205.11518/) (2022)
- [TraVaG: Differentially Private Trace Variant Generation Using GANs](https://mlsanity.com/paper/2303.16704/) (2023)
- [Setting varepsilon is not the Issue in Differential Privacy](https://mlsanity.com/paper/2511.06305/) (2025)
- [Effective and Privacy preserving Tabular Data Synthesizing](https://mlsanity.com/paper/2108.10064/) (2021)
- [How Much User Context Do We Need? Privacy by Design in Mental Health NLP Application](https://mlsanity.com/paper/2209.02022/) (2022)
- [An Algorithm for Streaming Differentially Private Data](https://mlsanity.com/paper/2401.14577/) (2024)
- [Enhancing Learning with Label Differential Privacy by Vector Approximation](https://mlsanity.com/paper/2405.15150/) (2024)
- [Private Continual Counting of Unbounded Streams](https://mlsanity.com/paper/2506.15018/) (2025)
- [Smoothed Differential Privacy](https://mlsanity.com/paper/2107.01559/) (2021)
- [A unified interpretation of the Gaussian mechanism for differential privacy through the sensitivity index](https://mlsanity.com/paper/2109.10528/) (2021)
- [Differentially Private Learning of Hawkes Processes](https://mlsanity.com/paper/2207.13741/) (2022)
- [On PAC Learning Halfspaces in Non-interactive Local Privacy Model with Public Unlabeled Data](https://mlsanity.com/paper/2209.08319/) (2022)
- [Ranking Differential Privacy](https://mlsanity.com/paper/2301.00841/) (2023)
- [Beyond Statistical Estimation: Differentially Private Individual Computation via Shuffling](https://mlsanity.com/paper/2406.18145/) (2024)

## Abstract (arXiv)

In June 2016, Apple announced that it will deploy differential privacy for some user data collection in order to ensure privacy of user data, even from Apple. The details of Apple's approach remained sparse. Although several patents have since appeared hinting at the algorithms that may be used to achieve differential privacy, they did not include a precise explanation of the approach taken to privacy parameter choice. Such choice and the overall approach to privacy budget use and management are key questions for understanding the privacy protections provided by any deployment of differential privacy. In this work, through a combination of experiments, static and dynamic code analysis of macOS Sierra (Version 10.12) implementation, we shed light on the choices Apple made for privacy budget management. We discover and describe Apple's set-up for differentially private data processing, including the overall data pipeline, the parameters used for differentially private perturbation of each piece of data, and the frequency with which such data is sent to Apple's servers. We find that although Apple's deployment ensures that the (differential) privacy loss per each datum submitted to its servers is 1 or 2, the overall privacy loss permitted by the system is significantly higher, as high as 16 per day for the four initially announced applications of Emojis, New words, Deeplinks and Lookup Hints. Furthermore, Apple renews the privacy budget available every day, which leads to a possible privacy loss of 16 times the number of days since user opt-in to differentially private data collection for those four applications. We advocate that in order to claim the full benefits of differentially private data collection, Apple must give full transparency of its implementation, enable user choice in areas related to privacy loss, and set meaningful defaults on the privacy loss permitted.