Apple logs every App Store keystroke with no opt-out, researchers find

Mysk found that Apple records every keystroke in App Store searches with millisecond timestamps, enough to calculate typing speed.AppleInsider+1
The analytics data, sent to Apple's servers, also includes which App Store tab is open and the device's OS version, with no way to opt out.AppleInsider+1
The findings clash with Apple's privacy messaging at WWDC 2026, where executives touted on-device intelligence for new personalization features.The Next Web+1

Security researchers have revealed that Apple records every keystroke users make when searching the App Store, including timestamps precise enough to calculate typing speed, with no option to disable the data collection.

What Mysk Found

The discovery, disclosed on June 9 by security research firm Mysk via a post on X, shows that the App Store transmits detailed analytics to Apple each time a user types in the search bar. In a demonstration searching for "Tim Cook," the researchers showed ten timestamped entries — one for each character typed — logged down to fractions of a second. Apple can use this data to calculate how long it takes a user to spell a word, including pauses between letters.AppleInsider+2

The data also includes which App Store tab the user is viewing and the device's operating system version. Mysk clarified that these are analytics records sent to Apple's servers, not real-time search suggestion responses — meaning Apple stores a complete copy of the user's typing process.Fifth Third Bank+1

No Way to Opt Out

Mysk emphasized that users have no way to prevent this data collection through any settings or workaround. The researchers noted that outside the European Union and other regions with mandated alternative app stores, users have no choice but to use the App Store, making the tracking unavoidable.finance.sina.com.cn+1

The findings come days after Apple announced Personalized Collections at WWDC 2026, a feature that recommends apps based on user behavior. While Apple's developer documentation states that Personalized Collections use "on-device intelligence," Mysk's research indicates that detailed interaction data is nonetheless transmitted to Apple's servers as analytics.AppleInsider+3

Apple's Privacy Paradox

The revelations highlight a tension with Apple's public positioning on privacy. At WWDC 2026, senior vice president Craig Federighi stressed that "Apple ensures strict protection of personal information" through on-device processing. Apple has long marketed privacy as a "fundamental human right" and built features like App Tracking Transparency to limit third-party data collection.PCMag+1

Mysk has previously documented similar behavior dating back to iOS 14.6, when the researchers first found the App Store sending "every tap you make" to Apple even with personalized ads disabled. Users can request their stored App Store data through Apple's Privacy website, but cannot stop it from being collected in the first place.BGR+2

Sources (22)