Friday, June 12, 2026

App Store Personalized Recommendations and Keylogging

Sarah Perez:

This week, Apple announced a series of discovery features that will personalize app recommendations based on users’ interests and behavior, providing a new way for developers to have their app discovered.

At Apple’s Worldwide Developers Conference (WWDC), the iPhone maker introduced Personalized Collections in the App Store, which will showcase recommendations tailored to the individual. These will also include new “App Notes” that explain why the specific apps were recommended to you. Starting this week, you’ll find these new personalized suggestions in various places in the App Store, including the Apps or Games tab or on the Search tab.

Mysk:

Now Apple is putting the extensive identifiable analytics they collect in the App Store in action. They record every tap and there’s no way to turn it off.

They can even calculate your typing speed.

[…]

If you don’t like Apple Music privacy options, you can stream music from Spotify. But where else can you download apps on the iPhone?

The data is associated with your account and unencrypted.

Previously:

Update (2026-06-17): Mysk:

The screenshot in the sub-post was taken from a CSV file you get when requesting your data from Apple. It’s called “App Store Click Activity.” Every event contains 110 attributes 🤯

In this PDF, Apple describes the data points collected in this category.

I requested my own data yesterday but am still waiting for Apple to prepare it.

Mysk:

There’s an ongoing class action lawsuit against Apple related to this. In iOS 26, Apple added an option to “reset” the identifier associated with “usage statistics,” but we haven’t seen any effect for this option. The analytics are still identifiable and linked to the user.

See also: John Gruber, Thom Holwerda, MacRumors.

Update (2026-06-19): Mysk:

It is not only about recording your typing skills in the search field, the App Store app even reports how much time you spend on every part of an app description as you scroll, hence recording your reading skills 🙃.

Apple also forces iOS to open any App Store link in the App Store app, and that will immediately log a detailed event that user XYZ has viewed that particular app as well as the referrer.

[…]

This data collection is not new. Apple has been doing it at least since iOS 14 when we discovered it. All data collected is NOT anonymous. The data is associated with your Apple ID. This means that given a court order, Apple has to hand this data to law enforcement.

Mysk:

Just for fun, I generated a 1000-character text and pasted it in the search field in the App Store. Well, the analytics captured the entire text, linked it to my ID and sent it to Apple, before even pushing “enter”. Now imagine you accidentally paste something private in there🙃

Update (2026-06-23): I received my own personal data from Apple and can confirm that it does include my timestamped App Store search queries.

19 Comments RSS · Twitter · Mastodon


But I thought Apple cared about our privacy!


It's for reasons like this that it concerns me that Siri AI can supposedly read the screen and everything you're doing and adjust its behavior on that. It's a black box and we have nothing but the trust we place in Apple (which I think would be misplaced trust) that they're not going to be siphoning off and processing all of that data for all manner of privacy violating reasons.

Even if they aren't now, what do you think they're going to do with that data when their normal revenue sources inevitably level off and they still need to generate ever growing profits?


> But I thought Apple cared about our privacy!

But they do. Please note that they do not allow any other company to sell you apps, ensuring that no other company can ever keylog you while browsing for apps on an iPhone. Doesn't that make you feel happy, warm, and safe?


They’re putting this much effort into monitoring everything about my keyboard except how bad the actual typing experience is.


Even if they weren't keylogging and it was encrypted, keystroke biometrics are an identifying / fingerprinting metric (like a person's gait).

Apple is a PRISM company.


Mysk 🇨🇦🇩🇪
@mysk_co
·
Jun 10
If you block (xp . apple . com) then it [the key logging section of the personal privacy data requested from Apple] should be empty

That’s interesting.


This is another reason sideloading shouldn’t be optional. We need government regulation enforcing that users can download and install apps from anywhere they want


> But I thought Apple cared about our privacy!

I think they actually do, but ONLY between you and non-Apple.


It's not tracking if it's just Apple tracking you, right?

...right?


> I think they actually do, but ONLY between you and non-Apple.

Which means they don't care about the actual issue at all. They were just taking a baseball bat to their competitor's kneecaps while virtue signaling.

You're the customer AND the product. They were playing 4d chess and now it's checkmate mother fuckers!


Someone else

Are there online stores that don’t have search fields?

I mean, doesn’t a web site need to process the text you enter into the search field somehow? Are we expecting an old-style Yahoo! link tree?

Ah yes, this is in comparison to the ‘open web’ — which is totally tracking-free (except for the Google Analytics literally everywhere, oh and your credit card now knows who you bought from, as opposed to “Apple”)


> Are there online stores that don’t have search fields?

You're misunderstanding what people are complaining about.

> Ah yes, this is in comparison to the ‘open web’ — which is totally tracking-free

Nobody said that.


> I mean, doesn’t a web site need to process the text you enter into the search field somehow?

But it doesn't need to log an event on every key press for the purposes of serving you targeted ads with apparently no option to even opt out? I'm into freedom.... if some people like the ads and find them useful go for it but there should be a preference to opt out especially from a company like Apple who smugly lectures everybody about privacy all the time.

What's next, they going to log events when I type in the address bar in Safari? What about TextEdit?

And Google is creepy AF with their ads too but at least they are honest about it and don't pretend to have some moral high ground.


Someone else

So what if they log keypresses and the time between them? Is that a privacy thing people are really concerned about? What will it be used for?

“keyboard gait analysis” by the CIA or something?

And yes, targeted ads… inside the store… that you’re currently inside of. You have started or are already in a business relationship with Apple — is it unusual that a company you’re doing business with tries to tailor its service to you, their customer?

This is absolutely benign compared to actual tracking of you across apps and the web that Facebook, Google, and hundreds of other tracking services do, including your credit cards, your cell phone, etc.

Guess what: Apple is keeping your traffic, behavior, and purchases more private in iOS than if you used any other device, including a computer. Consider the circles of privacy and Apple’s is very small.

And yeah, if they were tracking that stuff in TextEdit, sure, that’s weird — but guess what: They’re not doing that, and they’re not serving ads inside TextEdit, either.

What a weird bunch of conspiracy theories going on in here. Stop this semantic flattening. This is not like the others.


Privacy is a human right except when Apple violates it 😂

> is it unusual that a company you’re doing business with tries to tailor its service to you, their customer?

This justification can be applied to any app or website not just the App Store. They all are collecting data on you to sell you something, or sell the data to someone else so they can sell you something. Some people actually like targeted ads. I’m surprised how many people opt in, if you ask them.

You are right other companies do the same shit but at least they don’t lecture us and claim moral superiority.


Where’s the evidence that the data is associated with the user’s Apple Account? An immutable account identifier that’s being sent to a server? If so that should be pretty easy to prove, because whoever made the claim also says it’s unencrypted.

Mysk’s screenshot looks a lot like the Console app on macOS, which is primarily used to stream system logs. Anyone can use that to stream local logs from their iPhone, take a screenshot like that, and accuse Apple of conspiring surveillance.


@Harvey You can request your personal data from Apple, and they will send you everything they’re storing that’s associated with your account. From the screenshot, it looks like Mysk found this in one of the CSV files they received.


@someoneelse not to mention dynamic pricing...


Where is the App Store's privacy nutrition label? If other companies where collecting every key stroke and permanently associating it with the user profile, Apple would require they disclose it.

Leave a Comment