View the Differential Privacy white paper (PDF)

Di ff erential Privacy

There are situations where Apple can improve the user experience by getting insight from what many of our users are doing, for example: What new words are trending and might make the most relevant suggestions? What websites have problems that could a ff ect battery life? Which emoji are chosen most often? The challenge is that the data which could drive the answers to those questions-such as what the users type on their keyboards-is personal.

A privacy-preserving system

Apple has adopted and further developed a technique known in the academic world as local di ff erential privacy to do something really exciting: gain insight into what many Apple users are doing, while helping to preserve the privacy of individual users. It is a technique that enables Apple to learn about the user community without learning about individuals in the community. Di ff erential privacy transforms the information shared with Apple before it ever leaves the user's device such that Apple can never reproduce the true data.

The di ff erential privacy technology used by Apple is rooted in the idea that statistical noise that is slightly biased can mask a user's individual data before it is shared with Apple. If many people are submitting the same data, the noise that has been added can average out over large numbers of data points, and Apple can see meaningful information emerge.

Di ff erential privacy is used as the first step of a system for data analysis that includes robust privacy protections at every stage. The system is opt-in and designed to provide transparency to the user. The first step we take is to privatize the information using local di ff erential privacy on the user's device. The purpose of privatization is to assure that Apple's servers don't receive clear data. Device identifiers are removed from the data, and it is transmitted to Apple over an encrypted channel. The Apple analysis system ingests the di ff erentially private contributions, dropping IP addresses and other metadata. The final stage is aggregation, where the privatized records are processed to compute the relevant statistics and the aggregate statistics are then shared with relevant Apple teams. Both the ingestion and aggregation stages are performed in a restricted access environment so even the privatized data isn't broadly accessible to Apple employees.

Privacy budget

The Apple di ff erential privacy implementation incorporates the concept of a perdonation privacy budget (quantified by the parameter epsilon), and sets a strict limit on the number of contributions from a user in order to preserve their privacy. The reason is that the slightly-biased noise used in di ff erential privacy tends to average out over a large numbers of contributions, making it theoretically possible to determine information about a user's activity over a large number of observations from a single user (though it's important to note that Apple doesn't associate any identifiers with information collected using di ff erential privacy).

Apple uses local di ff erential privacy to help protect the privacy of user activity in a given time period, while still gaining insight that improves the intelligence and usability of such features as:

• QuickType suggestions
• Emoji suggestions
• Lookup Hints
• Safari Energy Draining Domains
• Safari Autoplay Intent Detection (macOS High Sierra)
• Safari Crashing Domains (iOS 1 1)
• Health Type Usage (iOS 10.2)

For each feature, Apple seeks to make the privacy budget small while still collecting enough data to to enable Apple to improve features. Apple retains the collected data for a maximum of three months. The donations do not include any identifier, and IP addresses are not stored.