10 Total
2 High severity
6 Medium severity
2 Low severity
Summary

This is Apple's official privacy policy explaining what personal information Apple collects from iPhone, iPad, Mac, Apple Watch, and other Apple devices and services, and how that information is used. The most important thing for everyday users is that Apple collects a wide range of data including your location, health and fitness information, financial transaction details, browsing and search history, voice data from Siri, and device usage patterns — though Apple states it does not sell this data to third parties. You should review your iPhone's Privacy & Security settings to control location sharing, limit ad tracking, and manage which apps can access sensitive data like your health, microphone, and camera.

Technical Summary

This document is Apple's global Privacy Policy governing the collection, use, disclosure, and retention of personal data across Apple's hardware, software, and services ecosystem, with legal basis varying by jurisdiction (consent, legitimate interests, contractual necessity under GDPR; statutory rights under CCPA). The policy obligates Apple to disclose categories of personal data collected (including device identifiers, location data, health and fitness data, financial data, and browsing history), the purposes for processing, and the third parties with whom data is shared, while granting users rights to access, correct, delete, and port their data. A notable provision is Apple's claim that it does not sell personal data to third parties and does not share personal data with third parties for their own marketing purposes — a stronger commitment than many industry peers — though Apple does share data with service providers, partners, and third-party developers who have their own privacy practices. The policy engages GDPR (EU/UK), CCPA/CPRA (California), PIPEDA (Canada), and the Australian Privacy Act, with Apple Inc. (Cupertino, CA) serving as the primary data controller for most users and Apple Distribution International Ltd. (Ireland) for EU/EEA users, creating dual-entity accountability structures. Material compliance considerations include the breadth of data collected through first-party devices and services (HealthKit, Siri, iCloud, Apple Pay, App Store), Apple's role as both a controller and a platform enabling third-party data practices, and the need for users to separately review third-party app privacy policies for apps downloaded through the App Store.

Evidence Provenance
Captured April 19, 2026 06:03 UTC
Document ID CA-D-000024
Version ID CA-V-000637
Wayback Machine View archived versions →
SHA-256 cbbabe376f04eb7a801fba2b08f0b6fdada46061a4e36ff35f705039d8843f2a
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Cryptographically signed
Institutional Analysis

🔒 Institutional analysis locked

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.

Upgrade to Professional — $149/mo
Change Timeline
View full version history (0 captures) →
High Severity — 2 provisions
Medium Severity — 6 provisions
Low Severity — 2 provisions

Cross-platform context

See how other platforms handle Collection of Health and Fitness Data and similar clauses.

Compare across platforms →

Applicable Regulations

EU AI Act
European Union
BIPA
Illinois, USA
CCPA/CPRA
California, USA
COPPA
United States Federal
CFAA
United States Federal
CAN-SPAM
United States Federal
DMA
European Union
DMCA
United States Federal
DSA
European Union
FCRA
United States Federal
GDPR
European Union
GLBA
United States Federal
HIPAA
United States Federal
TCPA
United States Federal
UK GDPR
United Kingdom