Might not be used in the EU

For the GDPR to have impact here, wouldn't they have to be collecting the information in the first place? If they're doing all the work on your own computer, that wouldn't trigger any GDPR issues.

Data collection is still data collection, it doesn't matter whether I am the one processing that data or a third party :)

It does matter. Your interpretation of “data collection” leads to absurd results.

How far does this go? Are the Bayesian spam filters that email clients have had for years that use your own classifications GDPR violations because they collect data about what you do or don’t mark as spam? Is your browser a GDPR violation because it collects data about your system that can be used to fingerprint you? Does your OS violate the GDPR when it displays your most recently accessed files in a file picker or as first suggestions when you search for something? Is the SMART monitoring built into your drives a GDPR violation? My understanding of the GDPR is that it applies to data the company is collecting about you. If the company never gets the data in the first place, then they haven’t collected it.

1. Spam filters. No, the data was collected explicitly for the spam filter to work. Anything else? Not unless you consent to it. 2. Browser collection. The browser itself? There's an agreement when installing it. The websites? There's the cookie banners. 3. OS. Is it your data? No permission needed. Your device, your data. Other people's data? Unclear. Depends on what you told the person when you collected said data. 4. SMART. I don't know a lot about how it works.

I was talking about the data you collect. Your own data processed on your device, it's fine. Your own data uploaded to be processed? You're agreeing, and it has to be an unambiguous. Sending the data outsids the EU? Explicit checkbox.

Is it absurd? Yes

your uninformed opinion about what the GDPR requires is absurd, yes. Because it is not correct.

> Your own data processed on your device, it's fine. Your own data uploaded to be processed?

Ok, but that seems to contradict your original assertion that it doesn't matter where the data is processed. The processes we're talking about run on your computer, processing data about you so that the services your OS provides can use that data to make the services work. That sounds a lot to me like "your own data processed on your device"

You should admit it’d be a bit silly to give notice to yourself that you are processing your own data!

> Data collection is still data collection, it doesn't matter whether I am the one processing that data or a third party

It absolutely matters who collects or processes for who must be GDPR compliant.

If it is stored entirely on the machine you own, then you are processing and storing the data.

More and more companies will start to use this loophole...

Next, Google will be downloading a database of 2 billion ads to your PC to check against all your private data and decide which ad to show you for anything you search in the future.

And because its all on your PC, no GDPR issues - you are processing your own data.

in this hypothetical setup you're effectively downloading malware, I wouldn't really consider that a loophole. Regulation that concerns data ownership can do precisely what the name says, give you control over where your data lives.

If you have full sovereignty over your data and your computer and you decide to use software that downloads ads and blasts them to you, at some point even in the best jurisdiction you're responsible for what you install

This is how privacy-preserving advertising works, yes. To be entirely honest if this works I think I’d agree with that term!

[delayed]

Vendor of guns will know that people visiting their website like guns. And similarly for other toys with a barrel. Oh no.

I mean…yeah? At some point you’re going to give them your credit card info and home address

It all lives on your device. Apple literally doesn’t have custody of the data so it’s not relevant to the GDPR. It’s your data.

Were that were so!

iCloud Backup, on by default, is not end to end encrypted and uploads almost the entire contents of your device to Apple’s servers every night in a format they can read (effectively unencrypted). This includes your entire message history over SMS and iMessage and all attachments thereto.

It is safe to assume that the data collected and assembled by these daemons is part of the iCloud Backup, which you never have to explicitly enable; it happens when you log in to iCloud on the device, usually within minutes of first powering it on for most people.

This data is not included in iCloud backup. That detail is included in the article.

> This data is not included in iCloud backup. That detail is included in the article.

The word "backup" does not appear at all in that webpage? Your claim is unsubstantiated. For these features to work, they must be running on iOS as well, for people who don't own a mac. Siri is used more on mobile devices than on desktops, generally.

Photos aren’t in iCloud Backup. Have you considered doing the bare minimum to understand the features you complain about?

They don't need to be; Photos are synced in realtime to Apple without e2ee. Apple already has them, even faster than the nightly backup.

>iCloud Backup, on by default

iCloud is not on by default with macOS. For starters, you have to create an iCloud account!

While not the default, with Advanced Data Protection, iCloud Backup does encrypt backups end to end. It’s available in most jurisdictions.

https://support.apple.com/en-us/102651#advanced

Also available to any other app with "full disk access" to just read and upload. A permission that make apps ask for and others need to work (e.g. a terminal replacement).

Every piece of data on your computer that is owned by your user is available to any other app you run as your user. That's hardly unique to this data, and is a well known issue when it comes to personal data and the applications you run under the unix permissions model. That this is at least behind the "full disk access" control makes it more protected than something like all of the tax and accounting data your financial software is storing in your Documents or home folder (well, technically under macOS your Documents folder also has its own permission, but it's the same sort of thing where anything with permission to read from your Documents folder can read anything in there).

It's an eternal balancing act because every time Apple implements some new restriction in their OS that prevents apps from doing whatever they want, whenever they want, people get mad at them. But without those restrictions, the ever increasing amount of personal data that is stored on your computer is exposed to the ever increasing number of data slurping applications that you run.

This drives me crazy. I'm slowly working on isolating every application into it's own sandbox but the fact that this wasn't built into the kernel drives me up the wall.

>Every piece of data on your computer that is owned by your user is available to any other app you run as your user.

That not being the case is the whole purpose of the per-app sandboxes which macOS has along with TCC. We're not discussing plain Unix permissions alone.

Ok, and the data is in a location that you need to grant full disk access to an application in order to access it. So what is the complaint here? Is it that if you run an application and give it access to the data that it has access to the data?

> A permission that make apps ask for and others need to work (e.g. a terminal replacement).

I assume you mean 'many' and not 'make'—this is untrue; you only need to grant FDA if you're trying to access protected areas, like the knowledge graph store.

Granting full disk access to an app that you don't trust not to surreptitiously exfiltrate your data is the kind of user error where the buck stops with PEBCAK.

Which is why Apple is so skittish about "full disk access".

https://developer.apple.com/news/?id=p6zjojqw