We have a word for what Apple is installing on your device: spyware. And it's worse than typical spyware in that it's using your device to spy on you and report its findings back to law enforcement.
But to your theme — there’s no clear bright line in client SDKs.
Devs do not think of these or handle these as if they belong to the user.
If you study the cesspool of user tracking and other privacy violations on iOS devices, it’s mostly developers using the same client-side SDKs across their apps, and users none the wiser.
Sometimes devs also have no idea. At least, they profess surprise and drop these SDKs when the user behavior harvesting is pointed out to them.
For whatever reason, everyone’s OK with this.
Perhaps the line is too blurred between client and server, thanks to emergence of concepts like node.js (“run same code on client or server”) that make this sound like a feature.
Or maybe it really shouldn’t matter where the code runs provided it respects boundaries, or better, those boundaries of intentionality and access are technically guaranteed inviolate.
I'll restate what I posted on another thread about this [0]. There should be a clear, bright line here.
----
In all these threads everyone is coming close to the crux of the issue, but I want to restate it in clearer terms:
There is a sacrosanct line between "public" and "private," "mine" and "yours." That line cannot be crossed by Western governments without a warrant. Cloud computing has deliberately blurred this line over time. This on-device scanning implementation blows right past that line.
Our tools before the computing revolution, and our devices after, become a part of us. Our proprioception extends to include them as part of "self." A personal device -- a tool that should be wholly owned and wholly dependable, like pen and paper -- that betrays its user, is a self that betrays itself.
[0]: https://news.ycombinator.com/item?id=28162412