There are a few notable privacy concerns with macOS that you should consider. These pertain to the operating system itself, and not Apple's other apps and services.

Brand-new Apple Silicon devices can be set up without an internet connection. However, recovering or resetting your Mac will require an internet connection to Apple's servers to check against the Activation Lock database of lost or stolen devices.

macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.

Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've posted information (https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised (http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.

While you can (https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.

Your account when you first set up your Mac will be an Administrator account, which has higher privileges than a Standard user account. macOS has a number of protections which prevent malware and other programs from abusing your Administrator privileges, so it is generally safe to use this account.

However, exploits in protective utilities like 'sudo' have been discovered in the past (https://bogner.sh/2014/03/another-mac-os-x-sudo-password-bypass). If you want to avoid the possibility that programs you run abuse your Administrator privileges, you could consider creating a second, Standard user account which you use for day-to-day operations. This has the added benefit of making it more obvious when an app needs admin access, because it will prompt you for credentials every time.

If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides guidance (https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.

When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys which Apple has access to by default. This is called Standard Data Protection (https://support.apple.com/en-us/102651) by Apple.

Therefore, if you use iCloud you should enable Advanced Data Protection (https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.

If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of System Settings.

There are a number of built-in settings you should confirm or change to harden your system. Open the Settings app:

* [ ] Turn off Bluetooth (unless you are currently using it)

Depending on if you are using Wi-Fi or Ethernet (denoted by a green dot and the word "connected"), click on the corresponding icon.

Click on the "Details" button by your network name:

* [x] Select Rotating under Private Wi-Fi address

* [x] Turn on Limit IP address tracking

Your firewall blocks unwanted network connections. The stricter your firewall settings are, the more secure your Mac is. However, certain services will be blocked. You should configure your firewall to be as strict as you can without blocking services you use.

* [x] Turn on Firewall

Click the Options button:

* [x] Turn on Block all incoming connections

If this configuration is too strict, you can come back and uncheck this. However, macOS will typically prompt you to allow incoming connections for an app if the app requests it.

By default, your device name will be something like "[your name]'s iMac". Because this name is publicly broadcast on your network (https://support.apple.com/guide/mac-help/change-computers-local-hostname-mac-mchlp2322/26/mac/26#:~:text=The%20local%20hostname%2C%20or%20local%20network%20name%2C%20is%20displayed%20at%20the%20bottom%20of%20the%20Sharing%20settings%20window.%20It%20identifies%20your%20Mac%20to%20Bonjour%2Dcompatible%20services.), you'll want to change your device name to something generic like "Mac".

Click on About and type your desired device name into the Name field.

You should automatically install all available updates to make sure your Mac has the latest security fixes.

Click the small icon next to Automatic Updates:

* [x] Turn on Download new updates when available

* [x] Turn on Install macOS updates

* [x] Turn on Install Security Responses and system files

If you do not use these features on macOS, you should disable them:

* [ ] Turn off Apple Intelligence

* [ ] Turn off Siri

Apple Intelligence (https://apple.com/legal/privacy/data/en/intelligence-engine) is only available if your device supports it. Apple Intelligence uses a combination of on-device processing and their Private Cloud Compute (https://security.apple.com/blog/private-cloud-compute) for things that take more processing power than your device can provide.

To see a report of all the data sent via Apple Intelligence, you can navigate to Privacy & Security → Apple Intelligence Report and press Export Activity to see activity from the either the last 15 minutes or 7 days, depending on what you set it for. Similar to the App Privacy Report which shows you the recent permissions accessed by the apps on your phone, the Apple Intelligence Report likewise shows what is being sent to Apple's servers while using Apple Intelligence.

By default, ChatGPT integration is disabled. If you don't want ChatGPT integration anymore, you can navigate to ChatGPT:

* [ ] Turn off Use ChatGPT

You can also have it ask for confirmation every time if you leave ChatGPT integration on:

* [x] Turn on Confirm Requests

Any request made with ChatGPT will be sent to ChatGPT's servers, there is no on-device processing and no PCC like with Apple Intelligence.

Whenever an application requests a permission, it will show up here. You can decide which applications you want to allow or deny specific permissions.

You can individually allow location services per-app. If you don't need apps to use your location, turning off location services entirely is the most private option.

* [ ] Turn off Location Services

Decide whether you want to share analytics data with Apple and app developers.

Decide whether you want personalized ads based on your usage.

* [ ] Turn off Personalized Ads

On modern devices with a Secure Enclave (Apple T2 Security Chip, Apple Silicon), your data is always encrypted, but is decrypted automatically by a hardware key if your device doesn't detect it's been tampered with. Enabling Tcf362fFileVault additionally requires your password to decrypt your data, greatly improving security, especially when powered off or before the first login after powering on.

On older Intel-based Mac computers, FileVault is the only form of disk encryption available by default, and should always be enabled.

* [x] Click Turn On

Lockdown Mode (https://support.apple.com/guide/mac-help/lock-mac-targeted-a-cyberattack-ibrw66f4e191/mac) disables some features in order to improve security. Some apps or features won't work the same way they do when it's off. For example, Javascript Just-In-Time (JIT (https://hacks.mozilla.org/2017/02/a-crash-course-in-just-in-time-jit-compilers)) compilation and WebAssembly (https://developer.mozilla.org/docs/WebAssembly) are disabled in Safari with Lockdown Mode enabled. We recommend enabling Lockdown Mode and seeing whether it significantly impacts daily usage.

* [x] Click Turn On

macOS uses a randomized MAC address when performing Wi-Fi scans (https://support.apple.com/guide/security/privacy-features-connecting-wireless-networks-secb9cb3140c/web) while disconnected from a network.

You can set your MAC address to be randomized (https://support.apple.com/en-us/102509) per network and rotate occasionally to prevent tracking between networks and on the same network over time.

Go to System Settings → Network → Wi-Fi → Details and set Private Wi-Fi address to either Fixed if you want a fixed but unique address for the network you're connected to, or Rotating if you want it to change over time.

Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in System Settings → General → Sharing.

T969389Part 1/2 Tcf362fNext

Tcf362fGuides Home Tcf362fSearch Guides

Tcf362fHome Tcf362fWiki Tcf362fTG Series Tcf362fChat Tcf362fArticles Tcf362fContact

Ta6a49eContent from Privacy Guides (privacyguides.org), commit 0295ab4.

Ta6a49eLicense: CC BY-SA 4.0 - creativecommons.org/licenses/by-sa/4.0