There have been many discussions lately around how companies use our data. These have been sparked by events such as the Cambridge Analytica scandal, where Cambridge Analytica may or may not have used Facebook’s data to influence the American elections. (Though they probably did.)

Thankfully, companies are becoming more transparent about their data practices. However, it’s not out of the goodness of their own hearts. The General Data Protection Regulation (GDPR), which came into force in the European Union in 2018, now forces companies to act responisbly when it comes to the data of their users. This includes allowing users to see their data on request.

I’ve had an iPhone for five years, so I thought I’d download all the data that Apple has on me.

Getting the data

Apple took five days to prepare my data. I don’t why it took so long. I can only guess that some poor Apple employee had to gather all the files manually.

But eventually they sent me an email with a link to a page that looked like this:

From here, I had to download each zip file one by one. Every time I downloaded a zip file, the web page would say I was no longer authenticated and the page would refresh, which was annoying. But eventually I had all folders downloaded and unzipped:

iCloud Drive

The biggest folder, at 784 MB, was called iCloud Drive, so looked there first. There must be loads of data there, I thought, ranging my minute-to-minute location to bowel habits.

But it turned out the reason this folder is so large was simply because it contains a video file. This was a video I'd downloaded from YouTube a couple of months ago.

Apart from this there wasn't much else in the iCloud drive folder. Probably that's because I don't use iCloud.

Data about me

Next I looked in a folder called “Renseignements sur le compte de identifiant Apple et sur les appareils”, which means, "Data about the user and his devices". The reason the folder names are in French is because I set my language to French at one point, and I never changed it back.

In this folder there are three files:

Apple ID Account Information.csv contains my name, phone numbers, email addresses, and past and current addresses. It’s a bit scary, especially because Apple knows four of my email addresses, even though I’ve only ever told them two.

Apple ID Device Information.csv contains data about my phone - its serial number, IMEI, MEID, etc.

Apple ID SignOn Information.csv is just a small spreadsheet with the Dates and time that I've logged into Apple's website.

Other data

Next I looked in the “Other Data” folder. With an anonymous name like that, there must be something good in this folder.

And I wasn't wrong. In a folder called Mail, I found a file called Recents.xml which has hundreds of email addresses of people I’ve sent emails to. What's surprising is that Apple has the email addresses even though I don't use an Apple email address. I'm sending emails from Hotmail and Gmail. What’s surprising is that Apple has been quietly watching me every time I send an email from my phone, no matter what email address I send it from.

A file called iCloudUsageData Set1.csv shows that Apple tracks my rough location, but only down to the city level.

In a folder called Communications marketing, there’s a list of marketing emails Apple has sent me, as well as whether I opened the email or not, which is a bit creepy.

Media

Next I looked in the “Information about Apple media” folder. Here I found a file called Store Transaction History.csv, which contains a list of all the purchases on my iPhone I’ve ever made:

Conclusion

It turns out that Apple has less data on me than I thought. It seems that's because Apple don’t actually store that much data on their users:

We have not included information contained within your account, if any, such as calendar contents, email contents, iTunes content etc. If you use iCloud you will note that we have extremely short retention periods for how long we store such data and we have provided all data that was available to us at the time at which we processed your request on our systems. I would also like to highlight the following from our message on Customer Privacy at https://www.apple.com/apples-commitment-to-customer-privacy: For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data. Similarly, we do not store data related to customers’ location, Map searches or Siri requests in any identifiable form.

So the takeaway message is: Apple knows things about me but not as much as I thought.