logoalt Hacker News

semiquaver • today at 3:53 PM • 1 reply • view on HN

It all lives on your device in order to make it work better. Apple literally doesn’t have custody of the data so it’s not relevant to the GDPR. It’s your data.


Replies

sneak • today at 3:57 PM

Were that were so!

iCloud Backup, on by default, is not end to end encrypted and uploads almost the entire contents of your device to Apple’s servers every night in a format they can read (effectively unencrypted). This includes your entire message history over SMS and iMessage and all attachments thereto. Photos and Contacts and Calendar aren’t included in the backup, but they don’t need to be, as those are synced to iCloud in realtime without end-to-end encryption (and readable by Apple).

(note: if you have Messages In iCloud enabled, then the iCloud backup includes a copy of that sync key instead of the messages themselves, so with the non-e2ee backup’s sync key and the e2ee Messages In iCloud traffic, Apple can read all of your messages that way.)

It is safe to assume that the data collected and assembled by these daemons is part of the iCloud Backup, which you never have to explicitly enable; it happens when you log in to iCloud on the device, usually within minutes of first powering it on for most people.

EDIT: the iCloud Backup (and the other non-e2ee data synced to icloud such as Contacts and Photos and Calendar that aren’t in the iCloud Backup) comprises all or most of the input data to these collectors; Apple can run the same models serverside over the same data to derive the same dossier.

➕ show 4 replies